Assessment Objective
Determine if:
- CM-07a. the system is configured to provide only [Assignment: mission-essential capabilities];
- CM-07b.
- CM-07b.[01] the use of [Assignment: functions] is prohibited or restricted;
- CM-07b.[02] the use of [Assignment: ports] is prohibited or restricted;
- CM-07b.[03] the use of [Assignment: protocols] is prohibited or restricted;
- CM-07b.[04] the use of [Assignment: software] is prohibited or restricted;
- CM-07b.[05] the use of [Assignment: services] is prohibited or restricted.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing least functionality in the system
- configuration management plan
- system design documentation
- system configuration settings and associated documentation
- system component inventory
- common secure configuration checklists
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with security configuration management responsibilities
- organizational personnel with information security responsibilities
- system/network administrators
- system developers
Test
- Organizational processes prohibiting or restricting functions, ports, protocols, software, and/or services
- mechanisms implementing restrictions or prohibition of functions, ports, protocols, software, and/or services
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | CM-07 [L] Least Functionality |