Least Functionality CM-7
Configuration Management · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds CM-7 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Configuration Management family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
CM-7 (Least Functionality) requires configuring the system to provide only essential capabilities — disabling or removing unnecessary services, ports, protocols, functions, and software — so the attack surface stays as small as possible. It carries from the Low baseline into Moderate.
What good looks like
- Enumerate what the host runs and what it listens on — services, ports, protocols, and installed software.
- Disable or remove functions, ports, protocols, and services that are not required.
- Restrict inbound access to only the ports and protocols the system genuinely needs.
- Review periodically to catch newly enabled or no-longer-needed functionality (drift).
- At Moderate, prevent or restrict the use of unauthorized software and functions.
Framework mapping
- NIST CSF 2.0 — PR.PS-01 — Configuration management practices are established and applied
- CIS Controls v8 — Control 4 — Secure Configuration of Enterprise Assets and Software (uninstall or disable unnecessary services)
How to move it toward Implemented
- This is met on VM 607: unused listeners were disabled with
systemctl disable --now, risky kernel and network features are turned off in99-hardening.conf, and UFW (Uncomplicated Firewall) is default-deny inbound with only a rate-limited SSH (Secure Shell) allowance plus the DVWA port open.ss -tulpnconfirms only the expected services listen. - Attach the dated as-built capture — the
ss -tulpnlistening-port output and the running-services list — as evidence, naming CM-7 in the Requirement field, to reach Completed. - Add a recurring
ss -tulpnand running-units check so any newly opened port or newly enabled service is caught as drift, satisfying CM-7's 'review periodically' expectation.