system upgrade

A planned, authorized lifecycle event in which one or more components of an operational information system — software, firmware, or hardware — are replaced or advanced to a newer version, typically involving a service interruption or maintenance window. It is distinguished from a routine patch or hotfix by its broader scope: a system upgrade commonly replaces a major version, introduces new functionality, or transitions the platform itself, rather than simply remediating a discrete vulnerability. In security and compliance frameworks it appears alongside scheduled maintenance as a category of anticipated downtime that must be governed by change-management controls — including authorization, scheduling, testing, and documented rollback plans — so that the upgrade event does not itself introduce new risk or violate availability commitments. The phrase is compositional (upgrade of a system) rather than a specialized term of art with a fixed regulatory definition, and its meaning is understood directly from its component words across NIST, CMMC, and related authority documents.