Does your organization have a documented process for maintaining production software throughout its lifecycle and securely disposing of it when no longer needed?
Explanation
Production software lifecycle management is what's being assessed: whether you have a documented process for maintaining software in production and disposing of it securely once retired. Proper software maintenance includes regular patching, updates, version control, and configuration management, while secure disposal ensures that outdated software doesn't create security vulnerabilities or compliance issues.
Evidence could include a documented software lifecycle management policy, procedures for software updates and patching, decommissioning checklists, and records of software disposal activities (such as certificates of destruction, wiping logs, or documentation of removal from systems).
Implementation Example
Maintain the software used in production environments, and securely dispose of software once it is no longer needed
ID: PR.PS-06.259
Context
- Function
- PR: PROTECT
- Category
- PR.PS: Platform Security
- Sub-Category
- Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
Related questions
- Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?
- Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?
- Does your organization have a process to monitor software for deviations from approved baselines?
- Does your organization implement and adhere to defined timeframes for routine and emergency patching as specified in your vulnerability management plan?
- Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?
- Does your organization have a process to identify and replace end-of-life software and services with supported versions?