Are only currently supported operating system(s), software, and libraries leveraged by the system(s)/application(s) that will have access to institution's data?

This question is asking whether your systems and applications use only operating systems, software, and libraries that are currently supported by their vendors or maintainers. Why this matters: Unsupported software no longer receives security patches or updates, creating significant security vulnerabilities. When vendors end support for a product (like Windows 7 or an old version of a web framework), they stop releasing patches for newly discovered security issues. This creates an expanding set of known, exploitable vulnerabilities that attackers can target. The guidance specifically mentions browser compatibility because web applications often have specific browser requirements. If your application only works with certain modern browsers, you should disclose that information. In a security assessment, this question helps evaluators understand if your environment contains legacy components that might introduce unnecessary risk to the institution's data. Organizations using end-of-life software components present a higher security risk. When answering this question: 1. Inventory all operating systems, software packages, and libraries used in your environment 2. Verify their support status with vendors/maintainers 3. Be transparent about any exceptions and mitigating controls 4. Include browser compatibility information for web applications