Old Computers, NIS2 and ISO 27001: Which to Replace and Which to Isolate

Let's be honest: besides regulatory requirements and costs, NIS2 is a good reason for responsible managers to take a real look at cybersecurity and at the condition of the equipment and systems they work with every day. Which companies are in scope and what the law requires is described in detail in our article NIS2 for Businesses. Here we cover something that is rarely discussed: old computers and systems, and when they should be replaced and when isolated.

Because the technical measures in NIS2 largely match those in the ISO 27001 standard, everything below also applies to companies preparing for certification, and to any company that simply does not want to be an easy target.

Why old systems are the first target

With the rise of artificial intelligence, attacks are becoming more and more automated. According to the EU Agency for Cybersecurity's ENISA Threat Landscape 2025 report, as early as the beginning of 2025 over 80% of the observed phishing and social engineering campaigns worldwide were AI-assisted. And in its 2026 report ENISA states that in 60% of the breaches where the way in was identified, attackers exploited a vulnerability. Attackers do not choose victims by company size. They scan the internet for the easiest entry points, and the first in line are:

• outdated systems out of support (EOL), for which security fixes are no longer released;
• unpatched firewalls and servers;
• poorly maintained workstations with outdated software or software downloaded from unofficial sources.

We described what this looks like in practice in our case study of an out-of-support mail server that was breached weeks after the vulnerability became public. Zimbra EOL - Case study. See also how to manage corporate network security and ransomware protection for business.

"If it works, it's fine"

I have heard it many times: "If it works, it's fine." "We have machines with Windows 7 in our factory." "I know a manager who still uses XP." The same now applies to Windows 10 - see Windows 10 after end of support: what your business should do now.

The fact that something works does not mean it is protected. A system out of support will not show that it is vulnerable. It will run normally until the day someone uses it as an entry point to the rest of the network.

Office computers get replaced

The rule for ordinary administrative computers is simple: if they do not support a current operating system, they are replaced with ones that do. There is no reason to take the risk there. A new computer costs little compared with the downtime and costs after a breach, and security updates start arriving automatically again.

When the old computer has to stay

The exceptions are computers connected to specialized equipment. These are cases with special controllers: old, highly specialized machines for which manufacturers never wrote drivers or software for newer operating systems.

This does not mean machines worth hundreds of thousands of euros have to be thrown away. It means the risk from the computers that control them must be assessed carefully, and the computers themselves isolated from the rest of the infrastructure. In practice this means:

• Inventory: know exactly which old computers you have, what they are for and who is responsible for them. A good starting point is an IT audit of the company infrastructure.
• Separate network: old computers sit in a separate segment, divided from the office network by a firewall.
• No internet: access only to what the machine actually uses, and nothing more.
• No unnecessary functions: services, shares and USB access that the work does not need are switched off.
• Controlled remote access: if the machine's manufacturer needs to connect, only through a secure channel and only when necessary.

20+ year old hardware: what happens if it burns out

There is another aspect: how do you maintain hardware that is 20 or more years old, and what happens if the hard disk or memory fails? If the computer that controls a production line stops, the line stops too.

This is also part of maintenance and business continuity planning:

• a full disk image from which the computer can be restored in hours, not days (see backing up company data and the disaster recovery plan);
• spare parts or a spare machine prepared in advance;
• a replacement plan for when the manufacturer offers a compatible solution.

ISO 27001 requires the same

NIS2 is a law, while ISO 27001 is an international standard that a company can voluntarily be certified against. The technical measures in the two largely match, though. Everything described above is also required by the Annex A controls of ISO 27001 (2022 version):

The difference is in what surrounds the technical measures. NIS2 adds obligations such as reporting incidents within short deadlines and personal accountability of management. ISO 27001 requires a management system for security with policies, risk assessment and internal audits. That is why an ISO 27001 certificate does not automatically mean NIS2 compliance, but it covers a large part of the technical foundation. We wrote more about the standard in the article What ISO 27001 Preparation Involves.

In general

Even if your company is not in scope of NIS2 and is not thinking about certification, the risk is the same. Attackers do not check whether you are in scope of the law. An inventory, updates, a separate network for old machines and backups are basic cyber hygiene for any company with computers, not just a regulatory requirement.

How we help with the technical measures

That is why we added a NIS2 package to our subscription support, covering the technical measures common to NIS2 and ISO 27001:

• EDR: detecting and stopping threats on computers and servers;
• SIEM: collecting and analyzing system events so an attack is seen in time;
• backups: we set up a suitable solution on your server or on ours (storage with us is charged separately);
• patch management: automatic tracking and applying of updates
• IPS (We work with the existing equipment; if it lacks similar functionality, we recommend a modern UTM/Next Generation Firewall): a system that recognizes and stops attacks on their way to the network.

On the Professional plan the package is included in the price, and for the Standard plan it can be added for an extra fee. In both cases we bring the IT environment into technical compliance with NIS2 and with the technical requirements of ISO 27001, and if you decide to get certified, we also help with the audit. The documentation, policies and risk assessment are prepared by our partner consultant, and you have one point of contact - us. Management accountability remains with the company. You will find a comparison of the plans on the plans page.

Frequently asked questions

Does ISO 27001 cover the NIS2 requirements?

Partly. The technical measures largely overlap: asset inventory, vulnerability management, backups, event monitoring and supplier security. NIS2, however, has obligations that ISO 27001 alone does not cover, for example reporting significant incidents within short deadlines (under the directive, an early warning within 24 hours and a notification within 72 hours) and personal accountability of management. The certificate is a good foundation, but it does not replace a check against the law.

Can I use Windows 7 under NIS2?

The law does not ban a specific operating system, but it requires vulnerability management, and Windows 7 has not received security updates since January 2020. Paid extended support also ended in January 2023. An office computer running Windows 7 must be replaced. If the computer controls a specialized machine and there is no alternative, it can stay, but isolated from the rest of the network and described in the risk assessment.

Do I have to replace all old computers?

No. Office computers that do not support a current operating system are replaced. Computers attached to specialized equipment are isolated, and a full disk image and spare parts are prepared for them. The first step in both cases is an inventory: know which computers you have and what they are used for.

Where to start

If you are not sure what is running on your network and which systems no longer receive updates, start with the cheapest step: a review of your environment. It commits you to nothing, but shows where the risk is.

How to keep all company devices under control is covered in Manage company devices without chaos.

Let's talk | See the plans