End of life / end of support
Stands forEOL / EOS
The date from which a product no longer receives security updates. After it, a new vulnerability will not be closed by a patch — it needs another decision.
Also calledEOL · EOS · unsupported software
The date from which the vendor no longer issues fixes, security fixes included. Where the line falls between end of life and end of support varies by vendor, but the operational result is the same: a new vulnerability will not get a patch.
That removes the asset from the patching process and moves it into a different one — upgrade, replace, isolate, or document an accepted risk.
§61.3 of Directive 364 requires identifying such assets and assessing the risk. The practical difficulty is the identification itself: the field holding an operating-system version in an inventory is usually free text, and reconciling what it says with a vendor's published lifecycle is work somebody has to do and not forget.