Mechanisms exist to ensure that software and data needed for information system component and service refreshes are obtained from trusted sources.