CCI-003376

Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to replace information system components when support for the components is no longer available from the developer, vendor, or manufacturer.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the hardware and software lists to ensure the organization being inspected/assessed replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer.

Compelling Evidence

1.) System security plan (SSP). 2.) System development life cycle (SDLC) documentation. 3.) Continuous monitoring plan for replacing information system components when support for the components is no longer available from the developer, vendor, or manufacturer.

The controls below (if any) were marked by NIST as being related to CCI-003376.