Questions? Call 1.800.716.8955

Objective 2.5CISSP

Ensure appropriate asset retention (End of Life (EOL), End of Support (EOS))

Domain 2 · Asset Security10% of exam

2.5 Ensure appropriate asset retention (End of Life (EOL), End of Support (EOS))

A product’s End of Life is when the manufacturer stops manufacturing the product.  The manufacturer might announce the EOL well in advance or might do so abruptly.  We do not want to buy a product that will become obsolete.  Before we purchase a product, we should ask

  • What is the EOL date, if announced, or when do we anticipate an EOL?

  • Will the manufacturer replace the product with a similar product?

  • Do other vendors make a similar product?

  • Will the manufacturer continue to support the product (warranty, repairs, patches, support, etc.)?

  • Can we still purchase OEM or aftermarket parts for the product?

  • Is it cost-effective to stockpile the product for further use?

For example, if you were buying a specific model of Cisco switch and Cisco decided that they were going to stop manufacturing it, you would expect the following

  • Cisco will announce the EOL date a year in advance

  • Cisco will continue to make patches / IOS updates for the switch

  • You can still obtain a replacement switch if yours fails under warranty

  • Cisco will make a newer model switch to replace the one that has reached the EOL

  • You can buy switches from other vendors such as HP, Juniper, etc., which might work well as replacements for the Cisco switches.  But you probably don’t want to mix and match switch vendors.

End of Service Life (EOSL).  A product’s End of Service Life is when the manufacturer stops supporting it.  This is generally a few years after the EOL, and no earlier than when the warranty on the last device sold has expired.

That means that we don’t have any more support from the manufacturer, warranty repairs, or patches.  We don’t want to buy a product that has reached its EOSL. 

If we have a device in use that is approaching its EOSL then we want to create a plan for replacing it before the EOSL has arrived.  We want to have enough time to evaluate the available replacement devices, install them, configure them, test them, and work out any issues so that we are not stuck.

In some cases, we might not have an available replacement device, such as in the case of a legacy system.  We might not have any choice but to keep using it.  We might try to obtain service from an independent repair shop, or we might try to obtain maintenance documentation from the manufacturer.

One question we should ask is whether the software we use will run on the replacement hardware, or whether the hardware we use will run the replacement software.

If the manufacturer declares bankruptcy, we might have an abrupt EOSL.

Product timeline: in production and supported, then End of Life when manufacturing stops, then End of Service Life a few years later when support stops; replacement should be planned before EOSL In production Manufactured, sold and supported End of Life (EOL) Manufacturing stops Often announced early End of Service Life Support, repairs and patches stop generally a few years later Plan the replacement before EOSL Evaluate, install, configure and test the replacement
End of Life stops manufacturing, End of Service Life stops support a few years later, so the replacement must be ready before EOSL.
Use ← → to move between sections