CCI-003376

Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer.

Implementation Guidance

Determine if system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer.

Validation Procedures

Examine: [SELECT FROM: System and services acquisition policy; procedures addressing the replacement or continued use of unsupported system components; documented evidence of replacing unsupported system components; documented approvals (including justification) for the continued use of unsupported system components; system security plan; supply chain risk management plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with the responsibility for the system development life cycle; organizational personnel responsible for component replacement]. Test: [SELECT FROM: Organizational processes for replacing unsupported system components; mechanisms supporting and/or implementing the replacement of unsupported system components].

The controls below (if any) were marked by NIST as being related to CCI-003376.