CM-07 Least Functionality
Configuration Management
Description
a. Configure the system to provide only [Assignment: organization-defined mission essential capabilities]; and b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].
Supplemental Guidance
Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality can also be achieved as part of the fundamental design and development of the system (see SA-08, SC-02, and SC-03).
Changes from Rev 4
Adds parameter text for 'mission' essential capabilities Discussion expanded slightly
Enhancements (9)
What NIST adds to this control. Select one to read its statement.
CM-07(01) Periodic Review ModerateHigh
a. Review the system [Assignment: organization-defined frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and b. Disable or remove [Assignment: organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure].
CM-07(02) Prevent Program Execution ModerateHigh
Prevent program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage].
CM-07(03) Registration Compliance
Ensure compliance with [Assignment: organization-defined registration requirements for functions, ports, protocols, and services].
CM-07(04) Unauthorized Software — Deny-by-exception
a. Identify [Assignment: organization-defined software programs not authorized to execute on the system]; b. Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and c. Review and update the list of unauthorized software programs [Assignment: organization-defined frequency].
CM-07(05) Authorized Software — Allow-by-exception ModerateHigh
a. Identify [Assignment: organization-defined software programs authorized to execute on the system]; b. Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and c. Review and update the list of authorized software programs [Assignment: organization-defined frequency].
CM-07(06) Confined Environments with Limited Privileges
Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: [Assignment: organization-defined user-installed software].
CM-07(07) Code Execution in Protected Environments
Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: organization-defined personnel or roles] when such code is: a. Obtained from sources with limited or no warranty; and/or b. Without the provision of source code.
CM-07(08) Binary or Machine Executable Code
a. Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code; and b. Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official.
CM-07(09) Prohibiting The Use of Unauthorized Hardware
a. Identify [Assignment: organization-defined hardware components authorized for system use]; b. Prohibit the use or connection of unauthorized hardware components; c. Review and update the list of authorized hardware components [Assignment: organization-defined frequency].
Patterns that use this control (13)
Grouped by the emphasis each pattern gives it.
Critical (4)
Important (5)
MITRE ATT&CK Techniques (225)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.