Availability of university information resources depend on reliable components and the prompt replacement of hardware and software components when necessary.


  • The information resource owner, or designee, is responsible for ensuring that the measures described in this Control are implemented. The intended audience for this Control includes, but is not limited to, all information resource owners and custodians.


  • 1

    The information resource owner, or designee shall, based on documented and approved risk management decisions:

    • 1.1

      Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or

    • 1.2

      Provide the options for alternative sources for continued support for unsupported components whether in-house support or qualified external provider.