Navigate

SI-2 (6)

SI-2 (6): Removal Of Previous Versions Of Software / Firmware

The organization removes [Assignment: organization-defined software and firmware components] after updated versions have been installed.

Supplemental

Previous versions of software and/or firmware components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software and/or firmware automatically from the information system.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to SI-2 (6).

Control	Description
No controls

Enhancements

The controls below (if any) add on to the requirements of SI-2 (6).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SI-2 (6).

CCI	Definition
CCI-002615	The organization defines the software components to be removed (e.g., previous versions) after updated versions have been installed.
CCI-002616	The organization defines the firmware components to be removed (e.g., previous versions) after updated versions have been installed.
CCI-002617	The organization removes organization-defined software components (e.g., previous versions) after updated versions have been installed.
CCI-002618	The organization removes organization-defined firmware components (e.g., previous versions) after updated versions have been installed.