alternative sources of support

A risk-management mechanism — either in-house or contracted externally — by which an organization maintains patches, updates, maintenance, and technical assistance for system components whose original vendor, developer, or manufacturer has ceased providing support. It is distinguished from ordinary vendor support by the fact that the original support chain has ended: the organization must actively procure or develop a substitute, such as custom patch development, third-party extended-support contracts, or open-source value-added provider arrangements. In practice the field invokes the concept specifically under controls governing unsupported or end-of-life system components that cannot be immediately replaced because they remain essential to mission or business operations — requiring documented organizational decisions about acceptable risk alongside the chosen support mechanism.