CCCS publishes guidance on identifying and managing risks from obsolete products

Original title: Obsolete products - ITSAP.00.095

CCCS has published ITSAP.00.095, guidance on managing obsolete products in IT environments. Although obsolete products may still function, their continued use introduces security and operational risks that are often not immediately apparent. The guidance helps organizations identify which products are obsolete, assess and manage the associated risks, and plan safe transitions to supported alternatives.

What changed

• CCCS published new guidance document ITSAP.00.095 on July 7, 2026 addressing the identification and management of obsolete products in organizations
• Guidance covers how to identify products that have reached end-of-life or are no longer supported by vendors
• Provides risk management approaches for addressing security and operational vulnerabilities introduced by obsolete product use
• Includes recommendations for planning and executing transitions from obsolete products to supported alternatives

Who is affected

Canadian organizations of all sizes responsible for managing IT infrastructure and cybersecurity

Summary generated by a language model; the official text prevails. Not legal advice.