STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

All products must be supported by the vendor or the development team.

DISA Rule

SV-222658r508029_rule

Vulnerability Number

V-222658

Group Title

SRG-APP-000516

Rule Version

APSC-DV-003240

Severity

CAT I

CCI(s)

CCI-000366 - The organization implements the security configuration settings.
CCI-003376 - The organization replaces information system components when support for the components is no longer available from the developer, vendor, or manufacturer.

Weight

Fix Recommendation

Remove or decommission all unsupported software products in the application.

Check Contents

Review the application documentation and interview the application administrator.

Identify all software components.

Review the version information and identify the vendor if COTS software.

Access the vendor website to verify the version is still supported.

Ask the application representative for proof that the application and all of its components are supported.

Examples of proof may include:

design documentation that includes support information, support specific contract documentation, successful creation of vendor support tickets, website toll free support phone numbers etcetera.

If any of the software components are not supported by a COTS vendor or a GOTS organization, this is a finding.

All products must be supported by the vendor or the development team.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments