BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

SA-22 Unsupported System Components

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged SA Low baselineModerate baselineHigh baseline

Title

Unsupported System Components

Control

a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or
b. Provide the following options for alternative sources for continued support for unsupported components [Selection (one or more): in-house support; {{ insert: param, sa-22_odp.02 }} ].

Discussion

Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts. An example of unsupported components includes when vendors no longer provide critical software patches or product updates, which can result in an opportunity for adversaries to exploit weaknesses in the installed components. Exceptions to replacing unsupported system components include systems that provide critical mission or business capabilities where newer technologies are not available or where the systems are so isolated that installing replacement components is not an option.

Alternative sources for support address the need to provide continued support for system components that are no longer supported by the original manufacturers, developers, or vendors when such components remain essential to organizational mission and business functions. If necessary, organizations can establish in-house support by developing customized patches for critical software components or, alternatively, obtain the services of external providers who provide ongoing support for the designated unsupported components through contractual relationships. Such contractual relationships can include open-source software value-added vendors. The increased risk of using unsupported system components can be mitigated, for example, by prohibiting the connection of such components to public or uncontrolled networks, or implementing other forms of isolation.

Parameters

sa-22_odp.01: [in-house support; {{ insert: param, sa-22_odp.02 }} ]
sa-22_odp.02: support from external providers

Related controls

pl-2, sa-3

STIG rules that implement this control 6

Apple macOS 26 (Tahoe) V1R4

Application Security and Development V6R5

Microsoft Windows Server 2025 V1R4

Red Hat Enterprise Linux 10 V1R3