Technology Refresh
LOW MODERATE HIGHRequirements NIST SOURCE
Plan for and implement a technology refresh schedule for the system throughout the system development life cycle.
Discussion (NIST Supplemental Guidance)
Technology refresh planning may encompass hardware, software, firmware, processes, personnel skill sets, suppliers, service providers, and facilities. The use of obsolete or nearing obsolete technology may increase the security and privacy risks associated with unsupported components, counterfeit or repurposed components, components unable to implement security or privacy requirements, slow or inoperable components, components from untrusted sources, inadvertent personnel error, or increased complexity. Technology refreshes typically occur during the operations and maintenance stage of the system development life cycle.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SA-3(3) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- a technology refresh schedule is planned for the system throughout the system development life cycle;
- a technology refresh schedule is implemented for the system throughout the system development life cycle.
Examine
[SELECT FROM: System and services acquisition policy; system and services acquisition procedures; procedures addressing technology refresh planning and implementation; system development life cycle documentation; technology refresh schedule; security risk assessment documentation; privacy impact assessment; privacy risk assessment documentation; system security plan; privacy plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with information security and privacy responsibilities; organizational personnel with system life cycle development responsibilities].
Test
[SELECT FROM: Organizational processes for defining and documenting the system development life cycle; organizational processes for identifying system development life cycle roles and responsibilities; organizational processes for integrating security and privacy risk management into the system development life cycle; mechanisms supporting and/or implementing the system development life cycle].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SA-3(3). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and services acquisition policy
- system security plan
- privacy plan
Testing
- Organizational processes for defining and documenting the system development life cycle
- organizational processes for identifying system development life cycle roles and responsibilities
- organizational processes for integrating security and privacy risk management into the system development life cycle
- mechanisms supporting and/or implementing the system development life cycle
Other Records
- system and services acquisition procedures
- procedures addressing technology refresh planning and implementation
- system development life cycle documentation
- technology refresh schedule
- security risk assessment documentation
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records