What is Lifecycle Management?
Lifecycle Management is the controlled management of the entire lifecycle of an asset, system, component or application, from specification and procurement through installation, operation and maintenance to phase-out or migration. In OT and IT environments it prevents installations from ageing unnoticed, spare parts from running out and systems from running without security updates. Lifecycle Management is therefore a continuous process that safeguards continuity, safety, security and compliance, not a one-off project.
🔄 What are the lifecycle phases of an OT asset?
IEC 62890 (lifecycle management for systems and components in industrial-process measurement, control and automation, 2020) describes a lifecycle model for both product types and installed instances, and asset management under ISO 55001 calls for control over the entire life of an organisation’s assets. For an OT asset, in practice this comes down to these phases:
| Phase | What happens? | Typical lifecycle activity |
|---|---|---|
| Specification | Define functional requirements, security requirements and expected lifetime | Apply Security by Design, include the support period as a requirement |
| Procurement | Choose supplier and product | Check the lifecycle status and support policy of the supplier |
| Installation and commissioning | Build, configure, test | FAT and SAT, record the baseline in configuration management |
| Operation | Production is running | Monitoring, keeping the asset inventory up to date |
| Maintenance | Preventive, corrective and predictive maintenance | Patch management, firmware updates, managing spare parts |
| Phase-out or migration | Replace, upgrade or dispose | Plan the migration, secure data, wipe equipment safely |
The phases overlap. A PLC in its maintenance phase may have been on the migration list for years, while a new extension of the same installation starts again in the specification phase.
🧠 Why is Lifecycle Management in OT so difficult?
In OT, two clocks collide. An installation often runs for 20 to 30 years, while suppliers typically sell and support a product generation for 10 to 15 years. On top of that:
- Long lifespans — PLCs and DCS platforms often run for twenty years or more, far longer than the software they depend on
- Limited ability to patch — updating requires a shutdown, retesting or recertification, especially for safety functions
- Dependence on suppliers — Firmware, engineering software and spare parts often come from a single manufacturer
- Critical processes — unplanned downtime immediately costs production or affects safety
| OT asset | Typical service life | Lifecycle challenge |
|---|---|---|
| PLCs and RTUs | 15–25 years | Firmware updates often require a restart and retest |
| DCS | 20–30 years (platform), with interim upgrades | Hardware, control software and Windows servers age at different rates |
| SCADA servers and HMI PCs | 5–10 years | Tied to Windows versions; since 14 October 2025 Windows 10 only receives paid security updates (ESU), while LTSC editions are supported for longer |
| Industrial network switches | 10–15 years | Firmware management often requires vendor tools or local access |
| Sensors and field devices | 15–30 years | Diagnostics and protocols age; replacement types are not always like-for-like |
📈 What does Lifecycle Management deliver?
Good lifecycle management needs structural attention, but it stops ageing from announcing itself only as a failure or an incident.
| Benefit | Explanation |
|---|---|
| Reliability | Fewer unplanned outages and less downtime, because replacement happens as planned |
| Security | Outdated firmware and unsupported software are identified and dealt with in time |
| Compliance | Demonstrable control for frameworks such as the BIO, IEC 62443 and ISO 27001 |
| Cost | Avoids costly emergency measures, rush purchases of second-hand parts and unplanned shutdowns |
| Continuity | Supports continuity management by preventing critical systems from suddenly becoming irreplaceable |
🏭 How do supplier lifecycle phases work?
Manufacturers publish a lifecycle status for every product. That status is the most important input for your replacement planning.
Siemens uses five phases:
| Phase | Meaning |
|---|---|
| PM300 | Active product, recommended for new projects |
| PM400 | Phase-out announced; still available new, start of the spare-parts period (usually ten years) |
| PM410 | Product cancellation; only available as a spare part or repair |
| PM490 | End of spare-part delivery and support |
| PM500 | End of the product lifecycle; no repair or support any more |
A well-known example is the SIMATIC S7-300: its phase-out was announced as of 1 October 2023, since 1 October 2025 the series has only been available as spare parts, and Siemens supplies parts until at least October 2033.
Rockwell Automation uses four statuses: Active, Active Mature (fully supported, but a successor exists), End of Life (discontinuation date announced, migrate and make last-time buys) and Discontinued (no longer manufactured, repair at most).
The phase-out announcement is the signal to act. If you only respond once a part can no longer be ordered, you migrate under time pressure.
🔐 How does security fit into the lifecycle?
Security is not a separate phase; it runs through the whole lifecycle. The IEC 62443 series divides the responsibilities:
| Standard | For whom | Lifecycle topic |
|---|---|---|
| IEC 62443-4-1 (2018) | Product suppliers | Secure development lifecycle with eight practices, including security update management and security guidelines for the user |
| IEC 62443-2-4 | Integrators and service providers | Requirements for patching, backups and management during delivery and maintenance |
| IEC TR 62443-2-3 (2015) | Asset owners and suppliers | Patch management for industrial systems, including the exchange of patch information |
| IEC 62443-2-1 (2024) | Asset owners | Security programme during operation, with a maturity model |
The Cyber Resilience Act makes the support period legally enforceable. Manufacturers of products with digital elements must set a support period that reflects the expected time of use, in principle at least five years. Each security update must then remain available for at least ten years, or for the rest of the support period if that is longer. The obligation to report actively exploited vulnerabilities has applied since 11 September 2026; almost all other obligations apply from 11 December 2027.
Systems that can no longer be patched need compensating controls: isolation through network segmentation, hardening, strict remote access and active vulnerability management. This is the domain of legacy systems.
🛠 Which measures belong to good Lifecycle Management?
- Up-to-date asset inventory — for each asset the type, firmware version, supplier, lifecycle status and support date
- Patch management — plan, test and roll out updates within maintenance windows
- Obsolescence management — draw up an obsolescence management plan in line with IEC 62402, monitor lifecycle statuses periodically and prioritise risks
- Spare parts strategy — keep critical parts in stock, make last-time buys when a phase-out is announced and agree repair contracts
- Network segmentation — isolate older but necessary systems
- Change management — carry out every replacement or upgrade in a controlled way and document it in configuration management
- Procurement policy — only select products with guaranteed support, a published update policy and preferably an SBOM
🧭 How do you plan a migration step by step?
- Take inventory — map all assets, including firmware, software versions and the engineering software needed to maintain them.
- Link the lifecycle status — compare each asset with the supplier’s lifecycle data (PM phase, End of Life date, operating-system support date).
- Assess the risk — combine criticality, spare-part availability and security impact, for example through a risk assessment in line with IEC 62443-3-2.
- Choose a strategy per asset — continue with stock, apply compensating controls, upgrade in phases or replace completely.
- Plan around maintenance shutdowns — control system migrations preferably coincide with planned shutdowns; reserve time for FAT, SAT and fallback scenarios.
- Secure the new baseline — update the inventory, backups and documentation and put the new assets under lifecycle monitoring straight away.
In the Netherlands, NIS2 and the Dutch Cybersecurity Act require demonstrable risk management, including supply chain security. For government organisations, the BIO also requires management of assets and technical vulnerabilities. An up-to-date lifecycle plan is strong evidence in audits, including under ISO 27001.
❓ Frequently asked questions
What is the difference between Lifecycle Management and asset management?
Asset management is about getting the most value from an organisation’s assets over their whole life, balancing cost, risk and performance, for example in line with ISO 55001. Lifecycle Management is the executive part of it: monitoring the phases, lifecycle statuses and replacement moments of individual systems and components.
How long does a PLC last?
In practice a PLC often runs for 15 to 25 years. The limiting factor is usually not the hardware itself but the availability of spare parts, engineering software and supplier support. Lifecycle Management tracks that data so that replacement can be planned in time.
What does PM400 mean at Siemens?
PM400 is the phase in which Siemens announces the phase-out of a product. The product can still be bought new, but the clock for the spare-parts period is running. For Lifecycle Management, PM400 is the moment to decide on a migration or a last-time buy.
What does the Cyber Resilience Act require about the support period?
The Cyber Resilience Act requires manufacturers to set a support period that matches the expected time of use, in principle at least five years. During that period they must handle vulnerabilities and deliver security updates. For Lifecycle Management, this means the support period can become a hard procurement requirement.
What do you do with a system that can no longer be patched?
In Lifecycle Management, a system without security updates stays in use with compensating controls: network segmentation, hardening, restricted access and monitoring. At the same time it belongs on the migration list with a concrete replacement date. This keeps the risk manageable until replacement.
Who is responsible for Lifecycle Management in OT?
The asset owner is ultimately responsible for Lifecycle Management. Suppliers provide lifecycle data and updates, integrators carry out changes and the IT department often manages servers and the network. Clear agreements between these parties, for example in line with IEC 62443-2-4, prevent ageing assets from falling through the cracks.
📌 In summary
Lifecycle Management tracks every OT and IT asset from specification to migration, so that replacement happens as planned rather than after a failure. With an up-to-date inventory, supplier lifecycle data, a spare parts strategy and security in line with IEC 62443 and the Cyber Resilience Act, IT and OT environments stay stable, secure and future-proof.