End-of-support OS migration risk letter

Overview

Clients defer OS upgrades until insurance or compliance forces change. A signed risk letter clarifies who owns residual risk when MSP flags EOS.

Contents

• System inventory: hostname, role, EOS date, current patch availability status.
• Threat summary: no security hotfixes, known exploit tradecraft.
• Recommended path: upgrade, isolate, or replace—with cost range and timeline.
• Residual risk acceptance signature from customer exec—not just IT manager if material.

Tone

Factual, non-alarmist; cite vendor lifecycle URLs; offer compensating controls (network segmentation, WAF-only exposure) if temporary.

Cadence

Resend annually if unchanged; log in CRM for renewal discussions.

Internal

Legal review template once per jurisdiction; do not guarantee breach immunity after signature—word carefully.

Ops tie-in

Automation flag tickets from unsupported OS automatically route to senior approval queue.