Assessment Objective
Determine if:
- SA-22a. system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer;
- SA-22b. [Selection (one or more): in-house support; [Assignment: support from external providers] ] provide options for alternative sources for continued support for unsupported components.
Assessment Methods
Examine
- System and services acquisition policy
- procedures addressing the replacement or continued use of unsupported system components
- documented evidence of replacing unsupported system components
- documented approvals (including justification) for the continued use of unsupported system components
- system security plan
- supply chain risk management plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- organizational personnel with the responsibility for the system development life cycle
- organizational personnel responsible for component replacement
Test
- Organizational processes for replacing unsupported system components
- mechanisms supporting and/or implementing the replacement of unsupported system components
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | SA-22 Unsupported System Components |