Sunset Products

Sunset products are older SRGs, STIGs, Checklists, or Tools (i.e., DISA Products) that MAY be relevant to the vendor products they address, but are no longer supported by DISA for various reasons. The most common reason for this lack of DISA support is that the vendor product is outdated, superseded by a newer vendor product, or may be vendor non-support.

The lack of DISA support means that there is no active maintenance of the DISA product thus no updates of the product will be published. Lack of DISAmaintenance means that any new vulnerability in the vendor’s product WILL NOT be captured for mitigation thus the DISA product either is, or will quickly become, out of date. Since DISA is no longer maintaining a given product, a SME responsible for, and knowledgeable about, the product may not be available thus customer support questions will most likely not be answerable.

While STIGs on the sunset list may still be applied to systems, it is important to utilize more up-to-date and actively maintained guidance products to ensure the highest level of security and support. Utilizing outdated guidance can pose significant risks as it may not account for recent vulnerabilities or changes in vendor products. System owners are always encouraged to use the latest security guidance and keep their systems up to date. If you’re using sunset guidance, you should be reviewing your system to determine if an update or upgrade will be warranted in the near future.