Organisations should have a clear plan detailing how phase-outs are managed. This plan should include, e.g., the processes involved and how transition to a new product is handled.
If the ICT product doesn't have the recent security functions and protocols, it shouldn't be used and should be phased out.
Phase-outs should be planned in advance, before the provider drops product support, to ensure the use of the latest security functions and protocols. For example, some older applications might have the latest security functions, but do not work well with newer exploit protections. In this scenario, exceptions should be made to avoid deactivating the protection entirely, but it is essential to remember that the phase-out process is likely to be relevant in the near future.
After the phase-out, it is important to evaluate the processes and document the lessons learned for the future.
