Navigate

SA-22

SA-22: Unsupported System Components

The organization:

a: Replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and

b: Provides justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.

Supplemental

Support for information system components includes, for example, software patches, firmware updates, replacement parts, and maintenance contracts. Unsupported components (e.g., when vendors are no longer providing critical software patches), provide a substantial opportunity for adversaries to exploit new weaknesses discovered in the currently installed components. Exceptions to replacing unsupported system components may include, for example, systems that provide critical mission/business capability where newer technologies are not available or where the systems are so isolated that installing replacement components is not an option.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SA-22.

Control	Description
PL-2	The organization: a: Develops a security plan for the information system that: 1: Is consistent with the organization’s enterprise architecture; 2: Explicitly defines the authorization boundary for the system; 3: Describes the operational context of the information system in terms of missions and business processes; 4: Provides the security categorization of the information system including supporting rationale; 5: Describes the operational environment for the information system and relationships with or connections to other information systems; 6: Provides an overview of the security requirements for the system; 7: Identifies any relevant overlays, if applicable; 8: Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and 9: Is reviewed and approved by the authorizing official or designated representative prior to plan implementation; b: Distributes copies of the security plan and communicates subsequent changes to the plan to [organization-defined personnel or roles]; c: Reviews the security plan for the information system [organization-defined frequency]; d: Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and e: Protects the security plan from unauthorized disclosure and modification.
SA-3	The organization: a: Manages the information system using [organization-defined system development life cycle] that incorporates information security considerations; b: Defines and documents information security roles and responsibilities throughout the system development life cycle; c: Identifies individuals having information security roles and responsibilities; and d: Integrates the organizational information security risk management process into system development life cycle activities.

Control

Description

PL-2

The organization:

a: Develops a security plan for the information system that:
- 1: Is consistent with the organization’s enterprise architecture;
- 2: Explicitly defines the authorization boundary for the system;
- 3: Describes the operational context of the information system in terms of missions and business processes;
- 4: Provides the security categorization of the information system including supporting rationale;
- 5: Describes the operational environment for the information system and relationships with or connections to other information systems;
- 6: Provides an overview of the security requirements for the system;
- 7: Identifies any relevant overlays, if applicable;
- 8: Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and
- 9: Is reviewed and approved by the authorizing official or designated representative prior to plan implementation;

b: Distributes copies of the security plan and communicates subsequent changes to the plan to [organization-defined personnel or roles];

c: Reviews the security plan for the information system [organization-defined frequency];

d: Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and

e: Protects the security plan from unauthorized disclosure and modification.

SA-3

The organization:

a: Manages the information system using [organization-defined system development life cycle] that incorporates information security considerations;

b: Defines and documents information security roles and responsibilities throughout the system development life cycle;

c: Identifies individuals having information security roles and responsibilities; and

d: Integrates the organizational information security risk management process into system development life cycle activities.

Enhancements

The controls below (if any) add on to the requirements of SA-22.

Control	Description
SA-22(1)	The organization provides [one or more of in-house support/ {{ insert: param, sa-22.1_prm_2 }} ] for unsupported information system components.

Related CCIs

The CCIs below are tied to SA-22.

CCI	Definition
CCI-003374	The organization documents approval for the continued use of unsupported system components required to satisfy mission/business needs.
CCI-003375	The organization provides justification for the continued use of unsupported system components required to satisfy mission/business needs.
CCI-003376	Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer.