SA-22: Unsupported System Components
Control Family:
Threats Addressed:
Baselines:
- Low
N/A
- Moderate
N/A
- High
N/A
Next Version:
- NIST Special Publication 800-53 Revision 5.2.0:
- SA-22: Unsupported System Components
Control Statement
The organization:
- Replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and
- Provides justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.
Supplemental Guidance
Support for information system components includes, for example, software patches, firmware updates, replacement parts, and maintenance contracts. Unsupported components (e.g., when vendors are no longer providing critical software patches), provide a substantial opportunity for adversaries to exploit new weaknesses discovered in the currently installed components. Exceptions to replacing unsupported system components may include, for example, systems that provide critical mission/business capability where newer technologies are not available or where the systems are so isolated that installing replacement components is not an option.
Control Enhancements
SA-22(1): Alternative Sources For Continued Support
Baseline(s):
The organization provides [Selection (one or more): in-house support; [Assignment: organization-defined support from external providers]] for unsupported information system components.