[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsa-22":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sa-22","SA-22","Unsupported System Components",17,"US National Institute of Standards and Technology (NIST)","**What it asks for.** System components must be replaced when the developer, vendor or manufacturer no longer supports them, or justified and documented alternative support must be provided for components that must stay in use.\n\n**In practice.** This means tracking end-of-life and end-of-support dates in the asset inventory, planning replacements in budgets and roadmaps, and maintaining a risk-accepted exception register with compensating controls such as isolation. Auditors look for lifecycle tracking, exception approvals and evidence that unsupported components are reduced over time. Extended support contracts can be a valid bridge while replacement is planned.\n\n**Common gaps.** Unsupported operating systems and appliances remain in production because replacement was never funded. Unsupported open source libraries are often invisible to inventory processes. End-of-support dates are also missed for firmware and embedded components.","a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or\n  b. Provide the following options for alternative sources for continued support for unsupported components [Selection: in-house support; {{ insert: param, sa-22_odp.02 }} ].\nDiscussion: Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts. An example of unsupported components includes when vendors no longer provide critical software patches or product updates, which can result in an opportunity for adversaries to exploit weaknesses in the installed components. Exceptions to replacing unsupported system components include systems that provide critical mission or business capabilities where newer technologies are not available or where the systems are so isolated that installing replacement components is not an option.\n\nAlternative sources for support address the need to provide continued support for system components that are no longer supported by the original manufacturers, developers, or vendors when such components remain essential to organizational mission and business functions. If necessary, organizations can establish in-house support by developing customized patches for critical software components or, alternatively, obtain the services of external providers who provide ongoing support for the designated unsupported components through contractual relationships. Such contractual relationships can include open-source software value-added vendors. The increased risk of using unsupported system components can be mitigated, for example, by prohibiting the connection of such components to public or uncontrolled networks, or implementing other forms of isolation.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"drupal-critical-rce-flaw-exploitable-without-login-via-contributed-modules","Drupal Critical RCE Flaw Exploitable Without Login via Contributed Modules","2026-10-15T14:20:53.999+00:00",{"slug":25,"title":26,"published_at":27},"hard-coded-credentials-in-end-of-life-johnson-controls-easyio-fg-expose-full-unauthorized-access","Hard-Coded Credentials in End-of-Life Johnson Controls EasyIO FG Expose Full Unauthorized Access","2026-10-06T18:22:26.891+00:00",{"slug":29,"title":30,"published_at":31},"end-of-life-rtu500-firmware-exposes-critical-infrastructure-to-high-severity-vulnerabilities","End-of-Life RTU500 Firmware Exposes Critical Infrastructure to High-Severity Vulnerabilities","2026-10-06T18:22:11.807+00:00",{"slug":33,"title":34,"published_at":35},"critical-vulnerabilities-in-botslab-dashcams-left-unpatched-by-vendor","Critical Vulnerabilities in Botslab Dashcams Left Unpatched by Vendor","2026-09-24T21:21:44.881+00:00",{"slug":37,"title":38,"published_at":39},"elementor-pro-plugin-flaw-exploited-immediately-after-patch-release","Elementor Pro Plugin Flaw Exploited Immediately After Patch Release","2026-09-05T14:20:19.809+00:00",{"slug":41,"title":42,"published_at":43},"critical-elementor-pro-plugin-flaw-enables-wordpress-site-takeovers","Critical Elementor Pro Plugin Flaw Enables WordPress Site Takeovers","2026-09-03T16:20:57.066+00:00",{"slug":45,"title":46,"published_at":47},"end-of-life-ais-transponder-leaves-vessels-exposed-to-unauthenticated-config-attacks","End-of-Life AIS Transponder Leaves Vessels Exposed to Unauthenticated Config Attacks","2026-08-25T20:22:41.703+00:00",{"slug":49,"title":50,"published_at":51},"critical-rce-flaws-in-sonicwall-gms-demand-immediate-patching","Critical RCE Flaws in SonicWall GMS Demand Immediate Patching","2026-08-12T08:21:28.042+00:00",{"slug":53,"title":54,"published_at":55},"critical-flaw-in-genetic-analyzers-could-corrupt-dna-test-results","Critical Flaw in Genetic Analyzers Could Corrupt DNA Test Results","2026-08-04T16:22:31.158+00:00",{"slug":57,"title":58,"published_at":59},"critical-wordpress-plugin-vulnerabilities-demand-immediate-patching","Critical WordPress Plugin Vulnerabilities Demand Immediate Patching","2026-08-01T04:20:17.992+00:00",{"slug":61,"title":62,"published_at":63},"abb-knx-legacy-firmware-lacks-integrity-checks-no-patch-possible","ABB KNX Legacy Firmware Lacks Integrity Checks, No Patch Possible","2026-07-28T17:20:37.684+00:00",{"slug":65,"title":66,"published_at":67},"zero-patch-rce-in-fastjson-1x-demands-immediate-mitigation","Zero-Patch RCE in Fastjson 1.x Demands Immediate Mitigation","2026-07-25T14:20:24.414+00:00",[69,74,79,84,89,93],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",14,{"slug":75,"name":76,"problem":77,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",10,{"slug":80,"name":81,"problem":82,"stories":83},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",5,{"slug":85,"name":86,"problem":87,"stories":88},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",3,{"slug":90,"name":91,"problem":92,"stories":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":94,"name":95,"problem":96,"stories":97},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",2,[99,104,108,112,118,122,127,133],{"family":100,"item":101,"code":102,"title":103,"together":73},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":100,"item":105,"code":106,"title":107,"together":73},"7","Control 7","Continuous Vulnerability Management",{"family":5,"item":109,"code":110,"title":111,"together":73},"si-2","SI-2","Flaw Remediation",{"family":113,"item":114,"code":115,"title":116,"together":117},"gdpr","32","Article 32","Security of processing",11,{"family":119,"item":120,"code":121,"title":121,"together":117},"itil","overview","ITIL",{"family":100,"item":123,"code":124,"title":125,"together":126},"12","Control 12","Network Infrastructure Management",8,{"family":128,"item":129,"code":130,"title":131,"together":132},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",7,{"family":128,"item":134,"code":135,"title":136,"together":137},"800-82","SP 800-82","SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security",6]