versions or applying patches that have significant impacts on the system’s security
assumptions (or of adopting an alternative product from a different supplier). A
supplier’s willingness to support older versions for a fee may be worth negotiating
during the product’s acquisition, as are custom modifications by the supplierto