Episode 112 — Spotlight: Unsupported System Components (SA-22)

Unsupported System Components (SA-22) addresses the risk of operating hardware or software that vendors no longer support. For the exam, candidates must understand that unsupported components lack security patches, compatibility updates, and warranty protections, creating potential entry points for exploitation. The control requires organizations to identify such components, document exceptions, and either upgrade, replace, isolate, or mitigate them within defined timelines. The purpose is to ensure that all deployed systems remain maintainable and defensible under current threat conditions. SA-22 underscores that risk increases exponentially as vendor support ends and technical debt accumulates.

Operationally, SA-22 depends on accurate asset inventories integrated with vulnerability and patch management systems. Regular reports flag approaching end-of-support dates so that planning and budgeting occur well before deadlines. Where upgrades are delayed, compensating measures—such as segmentation, restricted access, or enhanced monitoring—must be documented and approved by risk officials. Evidence includes vendor notices, inventory records, and remediation plans tied to system identifiers. Metrics track the number of unsupported components, average age beyond end-of-support, and percentage mitigated or replaced per quarter. Pitfalls include untracked embedded software, legacy dependencies hidden in supply chains, and tolerance for “temporary” exceptions that become permanent. Implementing SA-22 as a governance routine prevents avoidable exposures and reinforces the principle that unsupported equals unacceptable.
Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.