Handling of retired business application / application service with active infrastructure?

[Heather McElroy]

From a process related perspective, how do your organizations handle a business application's status when it is no longer in use but its child application service has mapped infrastructure which must stay operational for X amount of years due to regulatory purposes? Do you keep the business application and its downstream application services also operational even if no longer in use?  

[CMDB Whisperer]

Operational but Not In Use seems like a contradiction.  Are you saying that the infrastructure for a retired business application is actually operational?  It is plugged in,  and accessible by users?  If not, then it is not operational and you may need to reconsider whether you have captured this requirement correctly.  Does the regulatory requirement state that you need to keep the system intact and online?  Intact but taken offline?  Or does it simply state that you need to keep the CI data for a period of time for data retention purposes?  I'm not an expert in all regulations, but I have not heard of a regulation that requires you to keep a system running for a business application that is not in use, and it actually seems like it could result in some security risks to do so, since a retired business application isn't going to have as much visibility from a monitoring and maintenance perspective so this could leave your company open to outdated and unpatched software and hardware lying dormant.