Cessation of support

// Latticework implementation guidance · partial coverage

Track support and patch evidence for every operating-system layer

Practical suggestions for a Kubernetes or cloud system. Adapt these steps to your architecture and approved system boundary.

Implementation steps

1. Inventory container base images, node operating systems and internet-facing network devices separately. Assign owners and record vendor support dates.
2. Use the mapped policies to review declared base-image metadata. Drive patch decisions from actual vendor advisories and vulnerability findings, then rebuild, deploy and verify the affected components within the applicable control deadline.

Evidence to retain

• Keep the component inventory, vendor advisory and release date, severity/exploit assessment, patch decision and deployment verification timestamps.
• Retain image labels and PolicyReports as supporting metadata. Add node and device patch records; labels do not verify installed patches or support state.

Responsibility boundary

Platform team: node and device lifecycle. Workload/pipeline team: supported base images and rebuilt artefacts. Organisation: patch policy, deadlines and approved exceptions.

The public mapping’s detector allocation is provisional for both managed and self-managed clusters. Agree the responsibility matrix for the engagement; provider inheritance and whole-control ownership require a reviewed system boundary and applicable customer/provider evidence.

Mapped checks to inspect

• kyverno: ism-patch-operating-systems-block-eol-base-images
• kyverno: ism-patch-operating-systems-require-base-image-label

These identifiers are from the pinned public mapping. Kyverno mappings describe the policy configuration you must inspect; they do not mean a policy is installed or enforcing. A manifest scan cannot establish live runtime behaviour. Record the exact tool, policy and framework versions, settings, exclusions and execution time with each result.

Review the mapping and control-specific limitations at revision 07b348a. Supporting mapping excerpts (checks, evidence notes and responsibility allocations) are adapted from Latticework Systems’ public repository under Apache-2.0. ASD’s control wording stays under CC BY 4.0.

Official source

ASD’s ISM OSCAL v2026.09.4 · Original catalogue JSON · Pinned checksums and edition details

Control source identifier: ism-1501. Check the official release before relying on this snapshot for an assessment.