The application must be decommissioned when maintenance or support is no longer available.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70397	APSC-DV-003250	SV-85019r1_rule		High

Description
Unsupported software products should not be used because fixes to newly identified bugs will not be implemented by the vendor or development team. The lack of security updates can result in potential vulnerabilities. When maintenance updates and patches are no longer available, the application is no longer considered supported, and should be decommissioned.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2018-04-03

Details

Check Text ( C-70851r1_chk )
Interview the application representative and determine if all the application components are under maintenance contract. The entire application may be covered by a single maintenance agreement. The application should be decommissioned if maintenance or security support is no longer being provided by the vendor or by the development staff of a custom developed application. If the application or any of the application components are not being maintained, this is a finding.

Check Text ( C-70851r1_chk )

Interview the application representative and determine if all the application components are under maintenance contract. The entire application may be covered by a single maintenance agreement. The application should be decommissioned if maintenance or security support is no longer being provided by the vendor or by the development staff of a custom developed application.

If the application or any of the application components are not being maintained, this is a finding.

Fix Text (F-76633r1_fix)
Ensure there is maintenance for the application.