SA-22(1): Alternative Sources For Continued Support


(Not part of any baseline)

Warning icon.

Control is withdrawn in the next version of this control set and incorporated into: SA-22: Unsupported System Components.

Control Statement

The organization provides [Selection (one or more): in-house support; [Assignment: organization-defined support from external providers]] for unsupported information system components.

Supplemental Guidance

This control enhancement addresses the need to provide continued support for selected information system components that are no longer supported by the original developers, vendors, or manufacturers when such components remain essential to mission/business operations. Organizations can establish in-house support, for example, by developing customized patches for critical software components or secure the services of external providers who through contractual relationships, provide ongoing support for the designated unsupported components. Such contractual relationships can include, for example, Open Source Software value-added vendors.