Unsupported System Components (03.16.02)_unsupported-system-components

Unsupported System Components (03.16.02) Unsupported System Components

High-Level Description

Family: System and Services Acquisition Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI

Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer. Provide options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced.

What to Check

• Verify Unsupported System Components (03.16.02) Unsupported System Components is implemented for CUI systems
• Review SSP documentation for Unsupported System Components (03.16.02)
• Validate CMMC Level 2 assessment objective for Unsupported System Components (03.16.02)
• Confirm POA&M addresses any gaps for Unsupported System Components (03.16.02)

How to Test

Step 1: Review System Security Plan

Examine the SSP for Unsupported System Components (03.16.02) implementation description and responsible parties.

Step 2: Assess Implementation

# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable

# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null

# For cloud:
# Use cloud-audit-mcp tools to assess posture

Step 3: CMMC Assessment Validation

Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.

Tools

Remediation Guide

Requirement Statement

Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer. Provide options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced.

Supplemental Guidance

Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts. An example of unsupported components includes when vendors no longer provide critical software patches or product updates, which can result in opportunities for adversaries to exploit weaknesses or deficiencies in the installed components. Exceptions to replacing unsupported system components include systems that provide critical mission or business capabilities when newer technologies are unavailable or when the systems are so isolated that installing replacement components is not an option. Alternative sources of support address the need to provide continued support for system components that are no longer supported by the original manufacturers, developers, or vendors when such components remain essential to organizational missions and business functions. If necessary, organizations can establish in-house support by developing customized patches for critical software components or obtain the services of external service providers who provide ongoing support for unsupported components through contractual relationships. Such contractual relationships can include open-source software value-added vendors. The increased risk of using unsupported system components can be mitigated by prohibiting the connection of such components to public or uncontrolled networks or implementing other forms of isolation.

Risk Assessment

CWE Categories

References

• NIST SP 800-171 Rev 3
• NIST SP 800-171A Rev 3 (Assessment)
• CMMC Model Overview
• NIST OSCAL Content

Checklist

• SSP documents Unsupported System Components (03.16.02) implementation
• Evidence of operating effectiveness collected
• POA&M addresses any gaps
• CMMC assessment objective met
• Continuous monitoring active