PR.PS-02 Software is maintained, replaced, and removed commensurate with risk

Statement

Software is maintained, replaced, and removed commensurate with risk

Guidance

Perform routine and emergency patching within the timeframes specified in the vulnerability management plan

Guidance

Update container images, and deploy new container instances to replace rather than update existing instances

Guidance

Replace end-of-life software and service versions with supported, maintained versions

Guidance

Uninstall and remove unauthorized software and services that pose undue risks

Guidance

Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse

Guidance

Define and implement plans for software and service end-of-life maintenance support and obsolescence

1. Overview

1.1 References

• 6.6 Security patch management
• 6.10 Vulnerability handling and disclosure

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final