The lack of processes for system maintenance and support may result in compromise of system security due to latest updates not being made to systems in a timely manner.
The organization obtains maintenance support and/or spare parts for [Assignment: organization-defined information system components] within [Assignment: organization-defined time period] of failure.
Maintenance resources are made readily available to personnel.
No statewide control
Obtain information system maintenance policy; procedures addressing timely maintenance for the information system; service provider contracts and/or service level agreements; inventory and availability of spare parts; security plan; other relevant documents or records and ascertain if :
(I)the organization defines in the security plan, explicitly or by reference, key information system components.
(ii)the organization defines in the security plan, explicitly or by reference, the time period within which support and spare parts must be obtained after a failure.
(iii)the organization obtains maintenance support and spare parts for the organization-defined list of key information system components within the organization-defined time period of failure.
