Severity: Low Guidance CA
CCCS publishes guidance on identifying and managing risks from obsolete products
Original title: Obsolete products - ITSAP.00.095
- Published
- Source: cyber.gc.ca
- Effective
- Not stated
- Deadline
- Not stated
- Framework: CCCS guidance
- ITSP.10.033 Security and privacy controls and assurance activities catalogue source
Why it matters
CCCS has published ITSAP.00.095, guidance on managing obsolete products in IT environments. Although obsolete products may still function, their continued use introduces security and operational risks that are often not immediately apparent. The guidance helps organizations identify which products are obsolete, assess and manage the associated risks, and plan safe transitions to supported alternatives.
What changed
- CCCS published new guidance document ITSAP.00.095 on July 7, 2026 addressing the identification and management of obsolete products in organizations
- Guidance covers how to identify products that have reached end-of-life or are no longer supported by vendors
- Provides risk management approaches for addressing security and operational vulnerabilities introduced by obsolete product use
- Includes recommendations for planning and executing transitions from obsolete products to supported alternatives
Who is affected
Canadian organizations of all sizes responsible for managing IT infrastructure and cybersecurity
What to do
AI-assisted summary of the official document; the official text prevails. Not legal advice.