Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

sa-22(1)

unsupported system components  | alternative sources for continued support

assessment objective:

Determine if the organization:

sa-22(1)[1]

defines support from external providers to be provided for unsupported information system components;

sa-22(1)[2]

provides and/or obtains support for unsupported information system components from one or more of the following:

sa-22(1)[2][a]

in-house support; and/or

sa-22(1)[2][b]

organization-defined support from external providers.

potential assessment methods and objects:

Examine: [select from: System and services acquisition policy; procedures addressing support for unsupported information system components; solicitation documentation; acquisition documentation; acquisition contracts; service-level agreements; other relevant documents or records].

Interview: [select from: Organizational personnel with system and services acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with responsibility system development life cycle; organizational personnel or third-party external providers supporting information system components no longer supported by original developers, vendors, or manufacturers].

Test: [select from: Organizational processes for supporting system components no longer supported by original developers, vendors, or manufacturers; automated mechanisms providing support for system components no longer supported by original developers, vendors, or manufacturers].