CM-7 Least functionality
Requires the system to be configured to provide only the capabilities essential to its mission, and requires organization-defined functions, ports, protocols, software and services to be prohibited or restricted so that
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Vulnerability scanner / patch tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Port and service scan results reconciled to the approved list · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
- Evidence of removal or disabling of unnecessary components · Cloud console / configuration management
governing documentDocuments that govern the control
- Documented list of mission essential capabilities for the system · Policy repository / GRC workspace
- Defined list of prohibited or restricted functions, ports, protocols, software and services · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Vulnerability scanner / patch tooling); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Default services left running because nothing verified whether they were needed
- Prohibited list defined for workstations only and not for servers or appliances
- Scan results show unapproved listening services that nobody reconciles
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCM-6 Configuration settings · CM-8 System component inventory