A CIO observes that many information assets are hosted on legacy technology that can no longer be patched or updated. The systems are not currently in use, but business units are reluctant to decommis

Placing unpatched systems behind a firewall offers some protection but doesn't eliminate the inherent vulnerability of the system itself, especially if it remains accessible internally or if the firewall is ever compromised.

Isolating systems and disconnecting them from the internet reduces external attack vectors but may still leave them vulnerable to internal threats or make it difficult to access the information for retention purposes if it is truly needed.

Applying surcharges might incentivize decommissioning but does not resolve the underlying technical and regulatory issue of managing unsupportable systems with retention requirements, and could create resistance.

This approach addresses the root cause of the problem by establishing clear guidelines for the entire lifecycle of information assets, from creation to disposition, including data retention. Consulting with business units ensures their retention requirements are met within a secure framework, allowing for planned migration of data from unsupportable legacy systems to secure, compliant platforms, thereby enabling the safe decommissioning of obsolete technology.