SA-22 Unsupported System Components
Last Review: 10/1/22
Statement
WTAMU shall monitor all information resources and components to ensure they are still supported by the manufacturer. Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts. An example of unsupported components includes when vendors no longer provide critical software patches or product updates, which can result in an opportunity for adversaries to exploit weaknesses in the installed components.
Applicability
This Control applies to all West Texas A&M information resources. The intended audience for this Control includes all information resource developers, owners, and custodians of information resources.
Implementation
System owners shall:
- Replace system or system components when support for the components is no longer available from the developer, vendor, or manufacturer
- Alternative sources for continued support will be considered based on risk but must be approved by the CIO or ISO prior to end of support date provided by the developer, vendor, or manufacturer. This could include In-house support or third-party external providers.