Asset Lifecycle and End-of-Life Management
Key Takeaways
Subdomain 5.4 names asset lifecycle management and configuration and change management under asset protection.
End-of-life (EOL) software and devices are the outline's named example of lifecycle risk.
Retiring or replacing an asset is a change, so it needs authorization, documentation, and a way to reverse it.
Sanitizing storage before disposal links asset lifecycle to data handling (subdomain 5.1).
Source: ISC2 CC Exam Outline v01/2026, subdomain 5.4, checked 2026-10-22.
Asset Lifecycle Management in the 2026 Outline
Subdomain 5.4, Understand asset protection, names two topics: asset lifecycle management, with the outline's example of end-of-life (EOL) software and devices, and configuration and change management. Asset protection means knowing which assets exist, keeping them supported, and changing them in a controlled way.
Source: ISC2 Certified in Cybersecurity Exam Outline, effective September 1, 2026 (v01/2026), subdomain 5.4, checked 2026-10-22.
Tracking an Asset Through Its Life
An asset is protected only while someone knows it exists and whether it is still supported. Lifecycle management follows each asset from inventory through service to retirement. The outline's example, end-of-life software and devices, is the key risk point: once a vendor stops providing updates, known weaknesses are no longer fixed by that vendor.
| Lifecycle stage | Security question | Example |
|---|---|---|
| Inventory | Do we know the asset exists and who owns it? | A router appears in the asset register with a named owner |
| In service | Is it configured, patched, and monitored? | Updates are installed under change control |
| End of life | Is vendor support still available? | An operating system reaches end of support |
| Retirement | Is data removed and the asset disposed of safely? | Storage is sanitized before disposal |
Connecting Lifecycle to Change Management
Retiring or replacing an asset is a change. Good change management usually means the change is authorized, tested, documented, and reversible. Sanitizing storage media before disposal is a data-handling topic under subdomain 5.1, so one retirement can touch more than one outline subtopic.
Scenario: The Forgotten Server
A legacy server stays in a closet after its application moves to the cloud. It is missing from the asset register, its operating system is out of support, and it still answers on the network. The fix is to add it to inventory, decide whether to support or retire it, and remove it under change control with its storage sanitized.
Which action best reflects asset lifecycle management for end-of-life software?
Track the software's support status and plan its retirement or replacement
Keep running it indefinitely because it still works for the current users and no one has asked for a change yet
Disable its logging to reduce noise in the monitoring queue for analysts who review events each shift
Remove it without recording the change so the change log stays shorter and easier for auditors to read later
Order the stages for a single asset, from first to last.
Arrange the items in the correct order
End-of-life review
Inventory and ownership
Retirement and secure disposal
In-service maintenance under change control
Sections you finish are checked off in the contents.