SA-22: Unsupported System Components

NIST Baseline: Low 

DIR Required By:  07/20/2023 

Review Date:  08/08/2024 

  • The information resource owner, or designee shall, based on documented and approved risk management decisions: 
    • Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or 
    • Provide the options for alternative sources for continued support for unsupported components whether through an in-house support or qualified external provider; or 
    • Provide justification and document the approval for the continued use of unsupported system components required to satisfy mission/business needs. 

References/Additional Resources

None.  See any applicable internal procedures.