SA-22: UNSUPPORTED SYSTEM COMPONENTS
NOT SELECTED FOR INDUSTRIAL CONTROL SYSTEMS
The organization:
- a. Replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and
- b. Provides justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.
SUPPLEMENTAL GUIDANCE
Support for information system components includes, for example, software patches, firmware updates, replacement parts, and maintenance contracts. Unsupported components (e.g., when vendors are no longer providing critical software patches), provide a substantial opportunity for adversaries to exploit new weaknesses discovered in the currently installed components. Exceptions to replacing unsupported system components may include, for example, systems that provide critical mission/business capability where newer technologies are not available or where the systems are so isolated that installing replacement components is not an option.
RELATED CONTROLS: SA-22
CONTROL ENHANCEMENTS
SA-22 (1) UNSUPPORTED SYSTEM COMPONENTS | ALTERNATIVE SOURCES FOR CONTINUED SUPPORT
The organization provides [Selection (one or more): in-house support; [Assignment: organization-defined support from external providers]] for unsupported information system components.
Supplemental Guidance:
This control enhancement addresses the need to provide continued support for selected information system components that are no longer supported by the original developers, vendors, or manufacturers when such components remain essential to mission/business operations. Organizations can establish in-house support, for example, by developing customized patches for critical software components or secure the services of external providers who through contractual relationships, provide ongoing support for the designated unsupported components. Such contractual relationships can include, for example, Open Source Software value-added vendors.
REFERENCES:
- NIST Special Publication 800-82 | GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY