Domain 2 · Objective reference 2.5 · Chapter 17 of 62
Retain assets and manage end-of-support exposure
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Retention obligations and vendor support are different clocks.
Explore the anchors
Determine required retention and usability.
Concept matching activity
Match this task or description to its concept:
Track updates dependencies and end of support.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
Concepts and mechanisms
Asset retention concerns how long information and supporting capabilities remain needed, usable and appropriately protected. End of life and end of support are lifecycle conditions, not merely procurement dates. An unsupported system can continue functioning while losing routine correction and assurance options. Required retained information must also remain readable and accessible through suitable formats, keys and systems.
Design, evidence and tradeoffs
Assign owners for support status, migration, temporary safeguards and verified retirement. Balance business retention duties with privacy, security and unnecessary exposure. A compensating control should address the particular scenario and have an accountable review, not become an undocumented permanent exception. Retiring a system includes access, data and dependency changes as well as disposal.
Worked example
A regulated archive is migrated before its software loses support, with checks that records remain complete, readable and appropriately restricted.
Check your understanding
Why can an operationally healthy unsupported device still require action?
Show explanation
Its future correction, assurance and recovery capabilities can be inadequate despite current functionality.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.