Buyers expect a stated support period for each version, advance notice before it ends, and a security update commitment for that period. CISA's bad practices list names not communicating the support period for on-premises products, and the draft SSDF suggests notifying users of the end-of-life date.
What the documents say
- CISA and FBI Product Security Bad Practices, version 2.0: for on-premises products, not clearly communicating the support period is a listed practice to avoid. The document is non-binding.
- Draft SSDF 1.2, task PO.1.2 example 5: policies should cover the whole life cycle, "including notifying users of the impending end of software support and the date of software end-of-life."
- Draft SSDF 1.2, PW.4.4 example 4: check that components are still maintained, including software gained in a merger or acquisition.
What a good support page contains
| Field | Example of what to write |
|---|---|
| Product and version | Exact names, not "latest" |
| Release date | A date |
| End of security updates | A date, stated separately from feature support |
| End of life | A date after which no updates are provided |
| Notice period | How far ahead you will tell customers |
| Upgrade path | Which version to move to |
Rules for the page
- Separate "feature support" from "security fixes." Buyers care most about the second.
- Do not change a date silently. If you extend, say so, and if you shorten, notify customers directly.
- Show the date of the last review at the top.
- Make the page machine readable if you can, so buyers can pull it into inventory tools.
Your own supply chain
Your dates are only as good as your components. If a library in your product reaches end of life before your product does, you owe yourself a plan. See how to check components are still maintained.
Why this matters for public buyers
Agencies are also under pressure to remove unsupported equipment. CISA's BOD 26-02 does that for edge devices, and applies to agencies. See whether it applies to vendors.
Quick check
Is a support period legally required?
Not by the documents I read. They are guidance. A contract may still require one.
Should SaaS publish end of life dates?
For SaaS, publish deprecation timelines for features and APIs. The bad practices item is stated for on-premises products.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a fix version is identified for a finding. Support dates tell customers how long such fixes will keep coming.
Safeguard provides SBOM and dependency scanning and autonomous remediation with fix PRs, which is off by default with every category on Manual. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
