Advice on CMSMS maintenance contract

[DIGI3]

When we released 2.0, there were quite a few modules that needed (usually minor) changes to continue to work, and this was a challenge for those offering maintenance contracts.

After 2.x, security updates for the 1.x series were offered for one year. I imagine that would be the same if/when we do a 3.x series.

So, technically yes, to be fully secure you would need to stay up to date with all releases, but keep in mind that it was a decade between 1.0 and 2.0.

For my support contracts, I include something along the lines that occasionally there may be additional costs to stay up to date, but that those would be discussed in writing if and when required.