id: "SI-02(06)" title: "Removal of Previous Versions of Software and Firmware" family: "SI" family_name: "System and Information Integrity" sort_id: "si-02.06" priority: "P1" implementation_level: "system" parent: "SI-02" enhancement: True
Statement
Remove previous versions of {{ insert: param, si-02.06_odp }} after updated versions have been installed.
Guidance
Previous versions of software or firmware components that are not removed from the system after updates have been installed may be exploited by adversaries. Some products may automatically remove previous versions of software and firmware from the system.
Assessment Objective
previous versions of {{ insert: param, si-02.06_odp }} are removed after updated versions have been installed.
System and information integrity policy
system and information integrity procedures
procedures addressing flaw remediation
mechanisms supporting flaw remediation
system design documentation
system configuration settings and associated documentation
records of software and firmware component removals after updated versions are installed
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for flaw remediation
Mechanisms supporting and/or implementing the removal of previous versions of software/firmware