Security requirement
- a.Configure the system to provide only mission-essential capabilities.
- b.Prohibit or restrict use of the following functions, ports, protocols, connections, and services: [Organization-defined: functions] .
- c.Review the system [Organization-defined: frequency] to identify unnecessary or nonsecure functions, ports, protocols, connections, and services.
- d.Disable or remove functions, ports, protocols, connections, and services that are unnecessary or nonsecure.
Discussion
Systems can provide a variety of functions and services. Some functions and services that are routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. It may be convenient to provide multiple services from single system components. However, doing so increases risk over limiting the services provided by any one component. Where feasible, organizations limit functionality to a single function per component. Organizations review the functions and services provided by the system or system components to determine which functions and services are candidates for elimination. Organizations disable unused or unnecessary physical and logical ports and protocols to prevent the unauthorized connection of devices, the transfer of information, and tunneling. Organizations can employ network scanning tools, intrusion detection and prevention systems, and endpoint protection systems (e.g., firewalls and host-based intrusion detection systems) to identify and prevent the use of prohibited functions, ports, protocols, system connections, and services. Bluetooth, File Transfer Protocol (FTP), and peer-to-peer networking are examples of the types of protocols that organizations consider eliminating, restricting, or disabling.
Tailoring decisions required
Resolve these values through the governing organization’s approved tailoring and risk-management process before declaring the requirement implemented.
Implementation perspective
Treat Least Functionality as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to approved baselines, secure configuration, change control, inventories, and drift management within the CUI boundary.
- Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which CUI assets, data flows, users, and services are protected by this requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- approved baseline configurations
- change tickets and approvals
- configuration scan and drift reports
- software and hardware inventories
Common failure patterns
- baselines documented but not enforced
- emergency changes never reconciled
- cloud or ephemeral assets missing from inventory
- security impact analysis performed after deployment
Assessment objectives and methods
Assessment objectives (8)
- b.
the use of the following functions is prohibited or restricted: [Organization-defined: functions].
- b.
the use of the following ports is prohibited or restricted: [Organization-defined: ports].
- b.
the use of the following protocols is prohibited or restricted: [Organization-defined: protocols].
- b.
the use of the following connections is prohibited or restricted: [Organization-defined: connections].
- b.
the use of the following services is prohibited or restricted: [Organization-defined: services].
- c.
the system is reviewed [Organization-defined: frequency] to identify unnecessary or nonsecure functions, ports, protocols, connections, and services.
- d.
unnecessary or nonsecure functions, ports, protocols, connections, and services are disabled or removed.
- a.
the system is configured to provide only mission-essential capabilities.
Examine
- configuration management policy and procedures
- procedures for least functionality in the system
- configuration management plan
- system design documentation
- system configuration settings
- system component inventory
- common secure configuration checklists
- documented reviews of functions, ports, protocols, and services
- change control records
- system audit records
- system security plan
- other relevant documents or records
Interview
- personnel with configuration management responsibilities
- personnel with responsibilities for reviewing functions, ports, protocols, and services
- personnel with information security responsibilities
- system developers
- system administrators
Test
- processes for prohibiting or restricting functions, ports, protocols, and services
- processes for reviewing or disabling functions, ports, protocols, and services
- mechanisms for implementing the review and disabling of functions, ports, protocols, and services
- mechanisms for implementing restrictions on or the prohibition of functions, ports, protocols, and services
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-171 Revision 3 official publication ↗
- NIST SP 800-171A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.