PR.PS-02.243
Does your organization have a process to identify and replace end-of-life software and services with supported versions?
Explanation
Using outdated or unsupported software exposes organizations to security vulnerabilities that will no longer receive patches or updates from vendors. This includes operating systems, applications, libraries, frameworks, and cloud services that have reached their end-of-support dates. Organizations should maintain an inventory of all software assets with their version information and support timelines.
Evidence could include a software asset inventory with version and end-of-life dates, a documented process for monitoring vendor support announcements, and records of software upgrade/replacement projects completed within the past year.
Implementation Example
Replace end-of-life software and service versions with supported, maintained versions
ID: PR.PS-02.243
Context
- Function
- PR: PROTECT
- Category
- PR.PS: Platform Security
- Sub-Category
- Software is maintained, replaced, and removed commensurate with risk
Related questions
- Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?
- Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?
- Does your organization have a process to monitor software for deviations from approved baselines?
- Does your organization implement and adhere to defined timeframes for routine and emergency patching as specified in your vulnerability management plan?
- Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?
- Does your organization have a process to identify, uninstall, and remove unauthorized software and services that pose security risks?
