id: "SA-03(03)" title: "Technology Refresh" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-03.03" priority: "P1" implementation_level: "organization" parent: "SA-03" enhancement: True
Statement
Plan for and implement a technology refresh schedule for the system throughout the system development life cycle.
Guidance
Technology refresh planning may encompass hardware, software, firmware, processes, personnel skill sets, suppliers, service providers, and facilities. The use of obsolete or nearing obsolete technology may increase the security and privacy risks associated with unsupported components, counterfeit or repurposed components, components unable to implement security or privacy requirements, slow or inoperable components, components from untrusted sources, inadvertent personnel error, or increased complexity. Technology refreshes typically occur during the operations and maintenance stage of the system development life cycle.
Assessment Objective: a technology refresh schedule is planned for the system throughout the system development life cycle;
Assessment Objective: a technology refresh schedule is implemented for the system throughout the system development life cycle.
System and services acquisition policy
system and services acquisition procedures
procedures addressing technology refresh planning and implementation
system development life cycle documentation
technology refresh schedule
security risk assessment documentation
privacy impact assessment
privacy risk assessment documentation
system security plan
privacy plan
other relevant documents or records
Organizational personnel with information security and privacy responsibilities
organizational personnel with system life cycle development responsibilities
Organizational processes for defining and documenting the system development life cycle
organizational processes for identifying system development life cycle roles and responsibilities
organizational processes for integrating security and privacy risk management into the system development life cycle
mechanisms supporting and/or implementing the system development life cycle