Unneeded programs, ports, protocols, and services are disabled.
What it actually means
The concrete side of least functionality: identify the programs, ports, protocols, and services you actually need, and restrict or disable everything else — host firewalls, disabled services, blocked protocols.
Pass or fail — an assessor needs a "yes" to each
- Nonessential ports/protocols/services are disabled or blocked.
- Host and network firewalls enforce only-needed traffic.
- A list of permitted ports/services exists.
What to have ready
- Host firewall rules + disabled-service list
- Permitted ports/services baseline
- Network ACLs
Where teams trip up
- Open ports nobody can account for
- Legacy protocols (SMBv1, Telnet) still enabled
- No firewall on endpoints
See where this control puts your score
Run all 110 requirements free in about 10 minutes — or draft your SSP language for this control. No signup.
Calculate your SPRS score →Draft your SSP language →Connected requirements
More in Configuration Management (3.4)
3.4.1 — Inventory and baseline your systems3.4.2 — Enforce secure configuration settings3.4.3 — Control and log changes3.4.4 — Check changes before you make them3.4.5 — Restrict who can make changes3.4.6 — Least functionality3.4.8 — Control which software can run3.4.9 — Control user-installed software