Not always. Maintenance or subscription terms vary, and "maintenance" may mean bug fixes, minor releases, help desk access, or all three. Ask the vendor to state in writing that security fixes for your supported version are included, who delivers them, and what happens if the contract lapses.
What "maintenance" can mean
The word covers a lot of ground. Before you rely on it, split it into parts and ask about each one.
| Component | Question to ask |
|---|---|
| Security fixes | Included for my version, or only for the newest release? |
| Bug fixes | Same release line, or upgrade required? |
| New features | Included or a separate tier? |
| Technical support | Which hours, which channels, which response times? |
| Upgrade assistance | Any help migrating between versions? |
| Documentation and advisories | Access during the term and after? |
If the vendor tiers support, make sure security fixes sit in the base tier. The CISA Secure by Demand guide asks whether customers can easily install security patches and whether the manufacturer supports patches broadly. A vendor that gates security fixes behind a higher tier is worth knowing about before signing, not after a flaw is announced.
The lapse problem
What happens if you let maintenance lapse for a year and then renew? Possible answers include:
- Fixes released during the gap are available when you renew.
- Fixes released during the gap are not available unless you pay back fees.
- Support ends and you must upgrade to a new version.
None of these is automatically wrong, but each is a surprise if you did not ask. For security fixes, a gap during which you cannot obtain a patch is a gap in your defenses. Ask how the vendor treats a critical, widely exploited flaw during a lapse. Some vendors release such fixes to everyone. Do not assume yours does.
Who installs the fix
Hosted services: the vendor deploys. Your contract should say so, and say when you are told.
On-premises software: you install. The vendor should provide fixes in a form you can apply without a full re-implementation. NIST SP 800-40 Rev. 4 describes patching as identifying, prioritizing, acquiring, installing and verifying updates. "Acquiring" is the step maintenance pays for. The rest is yours.
Clauses to request
- Security fixes for the supported version line are included in the base maintenance or subscription terms.
- Fixes are delivered through a documented channel, with release notes naming the flaw.
- If the vendor ends maintenance for the product, it gives notice for a stated period and keeps releasing fixes for exploited flaws during that period.
- Security advisories remain accessible to you for the term and for a stated period after.
Have your counsel review the wording. This post is not legal advice.
A five minute check before renewal
Open the last contract. Find the words "maintenance" and "support." Find the definition. Ask whether it names security fixes. If it does not, ask the vendor to add a sentence at renewal. Vendors often agree to clarifying language that costs them nothing.
Safeguard fits on your side of this process: SBOM and dependency scanning plus compliance and evidence automation help you show what you run and when you fixed it. You can try the free scan at gold.safeguard.sh/scan on a dependency file or SBOM.
Quick check
Do subscription terms always cover security fixes?
No. Read the definition of the service and ask the vendor to confirm security fixes in writing.
Can a lapse leave me without a patch?
Possibly. Ask in advance how the vendor treats exploited flaws if your maintenance has lapsed.
Sources
Last reviewed: 19 October 2026.
