End-of-life (EOL) system
Also called: unsupported system, legacy system
In one sentence
Hardware or software the maker no longer updates, so newly found security holes never get fixed.
An end-of-life system (like an old Windows Server or an unsupported app) stops receiving security patches. It can't be made safe by patching, so it must be replaced or strictly isolated from the network and internet.
Why it's on your cyber insurance application
A named application question; disclosed and isolated is defensible, hidden on the main network triggers surcharges or declination.
What this looks like in practice
The one that catches people is the machine that can't be replaced: the PC attached to a lab analyzer, the terminal that runs a line-of-business app whose vendor disappeared. Put it on a register with what it does, what it can reach, and what you're doing about it. An unsupported system you've disclosed and isolated is defensible. The same system undisclosed is a problem at claim time.
How the Readiness Check scores it
The free Check asks the same question a carrier will. Here it is, why it's asked, and the fix if today's honest answer is no. The full application question list has the rest.
Patching & vulnerabilities
Do you run any systems that no longer receive security updates (end-of-life)?
Why carriers ask: Unpatched, internet-facing software is now a leading initial-access vector. Applications ask about patch cadence and end-of-life systems specifically.
If the answer is no: Replace what you can; isolate what you can't (separate VLAN, no internet). Either path turns a 'no' answer into a defensible one.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
Guides that cover this
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.