Has your organization established and implemented a formal hardware lifecycle management plan that addresses end-of-life maintenance support and obsolescence?
Explanation
Hardware lifecycle planning is under review: whether a formal, implemented plan addresses end-of-life support and obsolescence for your hardware. A comprehensive hardware lifecycle management plan helps prevent security vulnerabilities from outdated or unsupported hardware, ensures business continuity, and allows for proper budgeting and resource allocation for hardware replacements.
Evidence could include a documented hardware lifecycle management policy, an inventory database with end-of-life dates for all hardware assets, maintenance contracts with vendors, and a hardware refresh schedule or roadmap showing planned replacements for aging equipment.
Implementation Example
Define and implement plans for hardware end-of-life maintenance support and obsolescence
ID: PR.PS-03.248
Context
- Function
- PR: PROTECT
- Category
- PR.PS: Platform Security
- Sub-Category
- Hardware is maintained, replaced, and removed commensurate with risk
Related questions
- Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?
- Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?
- Does your organization have a process to monitor software for deviations from approved baselines?
- Does your organization implement and adhere to defined timeframes for routine and emergency patching as specified in your vulnerability management plan?
- Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?
- Does your organization have a process to identify and replace end-of-life software and services with supported versions?
