Does Apple have a policy regarding how long they will continue to release and support security fixes for each OS X release? I've looked around the Internet, and found some forum posts that claim "only for the current, and most recent previous, versions" but none appear to have an official reference. Further confounding the issue are some relatively recent posts claiming they still receive security updates for versions as old as 10.2.
My concern here is primarily from a security standpoint. The National Institute of Standards and Technology of the Department of Commerce of the United States of America states in this document: NIST SP 800-53, control SI-02 (Flaw Remediation) that there are requirements that (among other things) "The organization ... identifies, reports, and corrects information system flaws". For systems running OS's that are beyond their support lifecycle, we cannot be reliably expected to correct discovered vulnerabilities because the vendor will no longer supply patches. So, knowing a product's expected support lifecycle (and, especially, if it has already expired) is critical to continuing to maintain compliance with this control.
Does Apple provide this information anywhere online for the general public? What versions are currently supported (current version being Lion), and how long (presuming no change to the policy) will they continue to be supported?