Unsupported System Components SA-22
System and Services Acquisition · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds SA-22 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, System and Services Acquisition family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
SA-22 (Unsupported System Components) requires replacing components once the developer or vendor stops providing support (patches and updates), or — where continued use is necessary — documenting approved compensating controls and a risk rationale for the unsupported, end-of-life (EOL) component.
What good looks like
- Identify components approaching or past end-of-life or end-of-support.
- Replace unsupported components with supported versions before support ends.
- Where replacement is not yet feasible, obtain approval and document compensating controls plus a risk rationale for continued use.
- Track vendor support timelines so end-of-life items are caught early rather than after support lapses.
Framework mapping
- NIST CSF 2.0 — PR.PS-02 — Software is maintained, replaced, and removed commensurate with risk
- CIS Controls v8 — Control 2.2 — Ensure authorized software is currently supported
How to move it toward Implemented
- The detection and patching side is working: Step 0's
apt full-upgradeplusunattended-upgradeskeep packages on supported, patched versions, and the Lynis audit flags outdated or unsupported software. - The gap is a documented EOL plan: list the operating system and key components with their vendor support-end dates (the Ubuntu 26.04 LTS support window, the DVWA container base image) and define when and how each gets replaced.
- Add a periodic support-status check — for example
ubuntu-security-statusor the Lynis outdated-software finding — reviewed on a set cadence so EOL components are flagged before support lapses. - Attach the EOL and replacement plan naming SA-22 in the Requirement field to move this asset from partial toward Completed.