SI-2(6)

Requirement

Remove previous versions of [Assignment: organization-defined software and firmware components] after updated versions have been installed.

Discussion

Previous versions of software or firmware components that are not removed from the system after updates have been installed may be exploited by adversaries. Some products may automatically remove previous versions of software and firmware from the system.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing flaw remediation; mechanisms supporting flaw remediation; system design documentation; system configuration settings and associated documentation; records of software and firmware component removals after updated versions are installed; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for flaw remediation].

Test

[SELECT FROM: Mechanisms supporting and/or implementing the removal of previous versions of software/firmware].

ID	Assessment Objectives
SI-02(06)	previous versions of <SI-02(06)_ODP software and firmware components> are removed after updated versions have been installed.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!