03.16.02 Unsupported System Components

Statement

• a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer.

• b. Provide options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced.

Guidance

Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts. An example of unsupported components includes when vendors no longer provide critical software patches or product updates, which can result in opportunities for adversaries to exploit weaknesses or deficiencies in the installed components. Exceptions to replacing unsupported system components include systems that provide critical mission or business capabilities when newer technologies are unavailable or when the systems are so isolated that installing replacement components is not an option. Alternative sources of support address the need to provide continued support for system components that are no longer supported by the original manufacturers, developers, or vendors when such components remain essential to organizational missions and business functions. If necessary, organizations can establish in-house support by developing customized patches for critical software components or obtain the services of external service providers who provide ongoing support for unsupported components through contractual relationships. Such contractual relationships can include open-source software value-added vendors. The increased risk of using unsupported system components can be mitigated by prohibiting the connection of such components to public or uncontrolled networks or implementing other forms of isolation.

Assessment objective

options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced are provided.

Assessment objective

system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer.

Assessment method

• system and services acquisition policy and procedures procedures for the replacement or continued use of unsupported system components documented evidence of replacing unsupported system components documented approvals (including justification) for the continued use of unsupported system components SCRM plan system security plan other relevant documents or records

Assessment method

• personnel with system and service acquisition responsibilities personnel responsible for component replacement personnel with system development life cycle responsibilities personnel with information security responsibilities

Assessment method

• processes for replacing unsupported system components mechanisms for supporting or implementing the replacement of unsupported system components

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final