Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

Cross-Framework Defense Map

CM-7 — Least Functionality

Trace this SP 800-53 control to NIST CSF outcomes, CUI requirements, D3FEND defensive techniques, ATT&CK relationships, and related learning resources.

CM — Configuration Management · NIST SP 800-53 Release 5.2.0

Open the complete control page →
NIST SP 800-53 control context

CM-7 — Least Functionality

Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intru

Read the official statement, discussion, parameters, enhancements, and assessment methods →

Outcome layer

NIST CSF 2.0 informative references

These CSF Subcategories list this base control or one of its enhancements in the imported NIST informative reference.

CUI protection layer

NIST SP 800-171 and SP 800-172

SP 800-171 requirements sourcing this control

SP 800-172 enhanced requirements sourcing this control

No relationship is present in the currently imported source datasets.
Defensive engineering layer

MITRE D3FEND techniques

No relationship is present in the currently imported source datasets.
Adversary layer

MITRE ATT&CK relationships

Curated mitigation mappings

No relationship is present in the currently imported source datasets.

Inferred behavior relationships

Experimental: These relationships are inferred through D3FEND and must be validated against architecture, telemetry, and threat context.

No relationship is present in the currently imported source datasets.
Relationship boundaries

Use the map without overclaiming.

A CSF informative reference is not an equivalence statement. A source-control relationship is not proof of implementation. A D3FEND semantic relationship is not a product claim. An inferred ATT&CK link is a hypothesis for engineering analysis.

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST or MITRE. Informative references and cross-framework relationships support navigation and analysis; they do not establish compliance, applicability, equivalence, control inheritance, or guaranteed mitigation effectiveness.