SA-22 Unsupported System Components

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	None

Related controls: PL-2, SA-3

Control statement

• a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or
• b. Provide the following options for alternative sources for continued support for unsupported components [Selection (one or more): in-house support; [Assignment: organization-defined support from external providers] ].

NIST discussion

Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts. An example of unsupported components includes when vendors no longer provide critical software patches or product updates, which can result in an opportunity for adversaries to exploit weaknesses in the installed components. Exceptions to replacing unsupported system components include systems that provide critical mission or business capabilities where newer technologies are not available or where the systems are so isolated that installing replacement components is not an option.

Alternative sources for support address the need to provide continued support for system components that are no longer supported by the original manufacturers, developers, or vendors when such components remain essential to organizational mission and business functions. If necessary, organizations can establish in-house support by developing customized patches for critical software components or, alternatively, obtain the services of external providers who provide ongoing support for the designated unsupported components through contractual relationships. Such contractual relationships can include open-source software value-added vendors. The increased risk of using unsupported system components can be mitigated, for example, by prohibiting the connection of such components to public or uncontrolled networks, or implementing other forms of isolation.

Withdrawn enhancements: SA-22(1).

Assessment objectives (SP 800-53A)

Objectives and methods for SA-22

Determine if:

• SA-22a. system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer;
• SA-22b. [Selection (one or more): in-house support; [Assignment: organization-defined support from external providers] ] provide options for alternative sources for continued support for unsupported components.

Examine: System and services acquisition policy; procedures addressing the replacement or continued use of unsupported system components; documented evidence of replacing unsupported system components; documented approvals (including justification) for the continued use of unsupported system components; system security plan; supply chain risk management plan; other relevant documents or records.

Interview: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel with the responsibility for the system development life cycle; organizational personnel responsible for component replacement.

Test: Organizational processes for replacing unsupported system components; mechanisms supporting and/or implementing the replacement of unsupported system components.

Policy statement

• The System owner shall replace system components when support for them is no longer available from the developer, vendor or manufacturer. (SA-22a)
• The System owner shall plan and budget each replacement before the component’s announced end-of-support date. (SA-22a)
• Where a component cannot be replaced by its end-of-support date, the System owner shall provide the following options for alternative sources of continued support: Select one or more: in-house support; [Assignment: organization-defined support from external providers] Typical: support from an external provider under contract, such as extended vendor support or a third-party support provider; in-house support only for an isolated component whose replacement is scheduled. (SA-22b)
• The authorizing official shall approve each continued use of an unsupported component, for a set period, with the compensating measures recorded and the replacement tracked in the plan of action and milestones. (SA-22b)

Federal systems

OMB Circular A-130, Appendix I, section 4.i(8), requires agencies to prohibit the use of unsupported information systems and system components, and to give systems and components that cannot be appropriately protected a high priority for upgrade or replacement; section 5.p allows the same exceptions as NIST’s SA-22 discussion, with in-house or contracted support for them. CISA Binding Operational Directive 26-02, Mitigating Risk From End-of-Support Edge Devices (February 5, 2026), covers edge devices: devices on the boundary of an agency’s network that are reachable from the public internet. It requires agencies to update supported devices running end-of-support software immediately; to inventory devices on CISA’s end-of-support edge device list within 3 months; to decommission listed devices and report to CISA within 12 months; to decommission every end-of-support edge device within 18 months; and, within 24 months, to keep a continuous discovery process and inventory and decommission each edge device by its end-of-support date. As of September 2026.

• The System owner shall not use an unsupported system component except under an exception that OMB Circular A-130, Appendix I, section 5.p, allows, approved by the authorizing official. (SA-22a)
• The System owner shall inventory the system’s edge devices, replace or decommission each one that is end of support, and report each decommission to CISA, by the deadlines BOD 26-02 sets. (SA-22a)
• From the directive’s 24-month deadline, the System owner shall decommission each edge device on or before its end-of-support date, as BOD 26-02 requires. (SA-22a)

From the System and Services Acquisition Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SA-22 asks you to replace components when the developer, vendor or manufacturer stops supporting them. Where a component must stay, provide another source of support. An unsupported component gets no security updates, so each new vulnerability in it stays open. NIST’s SA-22 discussion allows exceptions only for critical capabilities with no newer technology, or systems so isolated that replacement is not an option. It suggests isolation, such as no connection to public or uncontrolled networks, to reduce the risk.

Common implementations. End-of-support dates recorded in the component inventory (CM-8) and reviewed each quarter against vendor announcements. Replacement planned and budgeted before the date (SA-2). Vulnerability scanners configured to flag unsupported operating systems, software and firmware. Under the patch and flaw remediation standard, section 8, an unsupported component is a flaw with a replacement date in the plan of action and milestones until it is gone. Where it must stay, an extended support contract, network isolation and extra monitoring, approved by the authorizing official for a set period.

Organization-defined parameters. Typical value, which your organization may set differently:

Parameter	Typical value
Alternative sources of continued support (b)	Support from an external provider under contract, such as extended vendor support or a third-party support provider; in-house support only for an isolated component whose replacement is scheduled

The value selects both options of the parameter, in-house support and external providers, with the external provider preferred. In the System and Services Acquisition policy, the authorizing official approves each continued use for a set period, with the compensating measures recorded.

Evidence assessors ask for.

• The component inventory with end-of-support dates
• Scan results showing no unsupported components, or each one matched to a plan of action and milestones item
• The authorizing official’s approval for each unsupported component still in use, with its compensating measures and end date
• Extended support contracts, with their coverage dates
• Budget or project records for the planned replacements

Inheritance. Organization-wide asset management and scanning may be common controls, and a cloud or managed service provider supports the components it runs. The system owns its own components, their replacement and any exception, so SA-22 is usually a hybrid control.

Common findings.

• An unsupported operating system found by the scanner with no plan of action and milestones item.
• An extended support contract that has lapsed, leaving the component unsupported again.
• Firmware on network devices, appliances and embedded systems left out of end-of-support tracking.
• “Isolated” systems that still have a route to the internet.

Enhancements in the Moderate baseline. SA-22 has no enhancements.

Federal systems (as of September 2026). OMB Circular A-130, Appendix I, section 4.i(8), requires agencies to prohibit unsupported information systems and components, and to give systems and components that cannot be protected a high priority for upgrade or replacement. Section 5.p allows the same exceptions as NIST’s SA-22 discussion, with in-house or contracted support. CISA Binding Operational Directive 26-02, Mitigating Risk From End-of-Support Edge Devices (February 5, 2026), covers devices on an agency’s network boundary that are reachable from the public internet. It requires agencies to:

• Update supported devices running end-of-support software immediately
• Inventory devices on CISA’s end-of-support edge device list within 3 months
• Decommission listed devices, and report to CISA, within 12 months
• Decommission every end-of-support edge device within 18 months
• Within 24 months, keep a continuous discovery process and decommission each edge device by its end-of-support date

Artifacts

• Acquisition Security Requirements
• System and Services Acquisition Decision Worksheet
• System and Services Acquisition Policy