SBCGA-LIFECYCLE: Contracts That Work in the Real World
- James W.
- 3 days ago
- 1 min read
Stop accepting "5-year support" for devices that last 15 years.
Smart procurement changes everything.
SBCGA-LIFECYCLE requires:
✓ Explicit 7-10 year security support contracts (not manufacturer goodwill)
✓ Defined vulnerability response times (48-72 hours for critical patches)
✓ Escalation pathways if vendors go dark
✓ Third-party patching rights if needed
✓ Supportability register tracking all devices and re-contracting timelines
This isn't asking for the impossible. It's contractual commitment to realistic timelines.
When you procure building IoT, you're not buying a product. You're buying a 20-year security obligation. Price and contract accordingly.
Most organizations don't think about procurement this way. They should.
Your building's security starts at the purchase order. Demand extended support. Get it in writing. Track renewal timelines.
SBCGA-LIFECYCLE: where smart building security begins.
Learn more → AC-146: "The Fifteen-Year Patch"
Comments