CM-7

CM-7 LEAST FUNCTIONALITY

Overview

Number	Title	Impact	Priority	Subject Area
CM-7	Least Functionality	LOW	P1	Configuration Management

Instructions
The organization: CM-7a. Configures the information system to provide only essential capabilities; and CM-7b. Prohibits or restricts the use of the following functions, ports, protocols, and/or services: Assignment: organization-defined prohibited or restricted functions, ports, protocols, and/or services.

Guidance
Information systems can provide a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Additionally, it is sometimes convenient to provide multiple services from single information system components, but doing so increases risk over limiting the services provided by any one component. Where feasible, organizations limit component functionality to a single function per device (e.g., email servers or web servers, but not both). Organizations review functions and services provided by information systems or individual components of information systems, to determine which functions and services are candidates for elimination (e.g., Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing). Organizations consider disabling unused or unnecessary physical and logical ports/protocols (e.g., Universal Serial Bus, File Transfer Protocol, and Hyper Text Transfer Protocol) on information systems to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling. Organizations can utilize network scanning tools, intrusion detection and prevention systems, and end-point protections such as firewalls and host-based intrusion detection systems to identify and prevent the use of prohibited functions, ports, protocols, and services.

Guidance

Information systems can provide a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Additionally, it is sometimes convenient to provide multiple services from single information system components, but doing so increases risk over limiting the services provided by any one component. Where feasible, organizations limit component functionality to a single function per device (e.g., email servers or web servers, but not both). Organizations review functions and services provided by information systems or individual components of information systems, to determine which functions and services are candidates for elimination (e.g., Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing). Organizations consider disabling unused or unnecessary physical and logical ports/protocols (e.g., Universal Serial Bus, File Transfer Protocol, and Hyper Text Transfer Protocol) on information systems to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling. Organizations can utilize network scanning tools, intrusion detection and prevention systems, and end-point protections such as firewalls and host-based intrusion detection systems to identify and prevent the use of prohibited functions, ports, protocols, and services.

Enhancements

CM-7 (1) Periodic Review

MODERATE

The organization can either make a determination of the relative security of the function, port, protocol, and/or service or base the security decision on the assessment of other entities. Bluetooth, FTP, and peer-to-peer networking are examples of less than secure protocols.

The organization:

CM-7 (1)(a)

Reviews the information system Assignment: organization-defined frequency to identify unnecessary and/or nonsecure functions, ports, protocols, and services; and

CM-7 (1)(b)

Disables Assignment: organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure.

CM-7 (2) Prevent Program Execution

MODERATE

The information system prevents program execution in accordance with Selection (one or more): Assignment: organization-defined policies regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

CM-7 (3) Registration Compliance

Organizations use the registration process to manage, track, and provide oversight for information systems and implemented functions, ports, protocols, and services.

The organization ensures compliance with Assignment: organization-defined registration requirements for functions, ports, protocols, and services.

CM-7 (4) Unauthorized Software / Blacklisting

MODERATE

The process used to identify software programs that are not authorized to execute on organizational information systems is commonly referred to as blacklisting. Organizations can implement CM-7 (5) instead of this control enhancement if whitelisting (the stronger of the two policies) is the preferred approach for restricting software program execution.

The organization:

CM-7 (4)(a)

Identifies Assignment: organization-defined software programs not authorized to execute on the information system;

CM-7 (4)(b)

Employs an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the information system; and

CM-7 (4)(c)

Reviews and updates the list of unauthorized software programs Assignment: organization-defined frequency.

CM-7 (5) Authorized Software / Whitelisting

HIGH

The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting. In addition to whitelisting, organizations consider verifying the integrity of white-listed software programs using, for example, cryptographic checksums, digital signatures, or hash functions. Verification of white-listed software can occur either prior to execution or at system startup.

The organization:

CM-7 (5)(a)

Identifies Assignment: organization-defined software programs authorized to execute on the information system;

CM-7 (5)(b)

Employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system; and

CM-7 (5)(c)

Reviews and updates the list of authorized software programs Assignment: organization-defined frequency.