Do you have a fully implemented solution support strategy that defines how many concurrent versions you support?

Version support is the focus of this item: assessors want to know that you have a defined strategy spelling out how many concurrent versions of your software you keep supported at once.

In security terms, this matters because older, unsupported versions may contain unpatched vulnerabilities that pose security risks. A clear version support policy helps customers understand when they need to upgrade to maintain security compliance and receive security updates.

The guidance specifically asks you to list the current version you support and what percentage of customers are using that version. This helps the assessor understand if most of your customers are on secure, supported versions or if there's a significant portion using potentially vulnerable older versions.

A good answer should include:

1. Confirmation that you have a documented version support policy
2. The number of concurrent versions you support (e.g., the current version and one previous version)
3. The specific version numbers currently supported
4. The percentage of customers on each supported version
5. Your approach to end-of-life notifications and migration support

This question helps organizations evaluate the security risk of adopting your solution based on how well you manage the lifecycle of your product versions.