+SA-22 Unsupported System Components
|
SA-22 Unsupported System Components
Control
- Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or
- Provide the following options for alternative sources for continued support for unsupported components [Selection(one-or-more): in-house support; {{ insert: param, sa-22_odp.02 }} ].
Discussion
Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts. An example of unsupported components includes when vendors no longer provide critical software patches or product updates, which can result in an opportunity for adversaries to exploit weaknesses in the installed components. Exceptions to replacing unsupported system components include systems that provide critical mission or business capabilities where newer technologies are not available or where the systems are so isolated that installing replacement components is not an option.
Alternative sources for support address the need to provide continued support for system components that are no longer supported by the original manufacturers, developers, or vendors when such components remain essential to organizational mission and business functions. If necessary, organizations can establish in-house support by developing customized patches for critical software components or, alternatively, obtain the services of external providers who provide ongoing support for the designated unsupported components through contractual relationships. Such contractual relationships can include open-source software value-added vendors. The increased risk of using unsupported system components can be mitigated, for example, by prohibiting the connection of such components to public or uncontrolled networks, or implementing other forms of isolation.
Assessment Objective
- system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer;
- [Selection(one-or-more): in-house support; {{ insert: param, sa-22_odp.02 }} ] provide options for alternative sources for continued support for unsupported components.
Assessment Method
Examine
System and services acquisition policy
procedures addressing the replacement or continued use of unsupported system components
documented evidence of replacing unsupported system components
documented approvals (including justification) for the continued use of unsupported system components
system security plan
supply chain risk management plan
other relevant documents or records
Interview
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
organizational personnel with the responsibility for the system development life cycle
organizational personnel responsible for component replacement
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|