alternative sources of support
163686·updated Oct 5, 2026A risk-management mechanism — either in-house or contracted externally — by which an organization maintains patches, updates, maintenance, and technical assistance for system components whose original vendor, developer, or manufacturer has ceased providing support. It is distinguished from ordinary vendor support by the fact that the original support chain has ended: the organization must actively procure or develop a substitute, such as custom patch development, third-party extended-support contracts, or open-source value-added provider arrangements. In practice the field invokes the concept specifically under controls governing unsupported or end-of-life system components that cannot be immediately replaced because they remain essential to mission or business operations — requiring documented organizational decisions about acceptable risk alongside the chosen support mechanism.
Source
Alternative sources of support address the need to provide continued support for system components that are no longer supported by the original manufacturers, developers, or vendors when such components remain essential to organizational missions and business functions. If necessary, organizations can establish in-house support by developing customized patches for critical software components or obtain the services of external service providers who provide ongoing support for unsupported components through contractual relationships. Such contractual relationships can include open-source software value-added vendors. The increased risk of using unsupported system components can be mitigated by prohibiting the connection of such components to public or uncontrolled networks or implementing other forms of isolation.the sentence this term was read in
generalized from a web lookup of the quoted expression, with 1 reviewed place(s) it is used as the term Verdict: term of art.
- SA-22: Unsupported System Components - CSF Tools
- 03.16.02: Unsupported System Components - CSF Tools
- SA-22(1): Alternative Sources For Continued Support - CSF Tools
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A risk-management mechanism — either in-house or contracted externally — by which an organization maintains patches, updates, maintenance, and technical assistance for system components whose original vendor, developer, or manufacturer has ceased providing support. It is distinguished from ordinary vendor support by the fact that the original support chain has ended: the organization must actively procure or develop a substitute, such as custom patch development, third-party extended-support contracts, or open-source value-added provider arrangements. In practice the field invokes the concept specifically under controls governing unsupported or end-of-life system components that cannot be immediately replaced because they remain essential to mission or business operations — requiring documented organizational decisions about acceptable risk alongside the chosen support mechanism.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- alternative sources of supports
- possessive
- alternative sources of support's
- pluralpossessive
- alternative sources of supports'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in NIST SP 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A risk-management mechanism — either in-house or contracted externally — by which an organization maintains patches, updates, maintenance, and technical assistance for system components whose original vendor, developer, or manufacturer has ceased providing support. It is distinguished from ordinary vendor support by the fact that the original support chain has ended: the organization must actively procure or develop a substitute, such as custom patch development, third-party extended-support contracts, or open-source value-added provider arrangements. In practice the field invokes the concept specifically under controls governing unsupported or end-of-life system components that cannot be immediately replaced because they remain essential to mission or business operations — requiring documented organizational decisions about acceptable risk alongside the chosen support mechanism.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.