The best source of information covering this requirement comes from NIST, the National Institute for Standards and Technology. They have a set of documents that are the standards for many requirements. There is nothing specific in the NIST guidelines about the end of life for Windows XP, however, the need to provide Flaw Remediation is clear and that is what the X, Office 2003 and Exchange 2003 support requirements fall under.
For example, NIST Special Publication (SP) 800-531 requires the SI-2, Flaw Remediation security control, which includes installing...