Assessment Objective

Determine if:

• CM-07(01)(a) the system is reviewed [Assignment: frequency] to identify unnecessary and/or non-secure functions, ports, protocols, software, and services:
• CM-07(01)(b)
  • CM-07(01)(b)[01] [Assignment: functions] deemed to be unnecessary and/or non-secure are disabled or removed;
  • CM-07(01)(b)[02] [Assignment: ports] deemed to be unnecessary and/or non-secure are disabled or removed;
  • CM-07(01)(b)[03] [Assignment: protocols] deemed to be unnecessary and/or non-secure are disabled or removed;
  • CM-07(01)(b)[04] [Assignment: software] deemed to be unnecessary and/or non-secure is disabled or removed;
  • CM-07(01)(b)[05] [Assignment: services] deemed to be unnecessary and/or non-secure are disabled or removed.

Assessment Methods

Examine

• Configuration management policy
• procedures addressing least functionality in the system
• configuration management plan
• system design documentation
• system configuration settings and associated documentation
• common secure configuration checklists
• documented reviews of functions, ports, protocols, and/or services
• change control records
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for reviewing functions, ports, protocols, and services on the system
• organizational personnel with information security responsibilities
• system/network administrators
• system developers

Test

• Organizational processes for reviewing or disabling functions, ports, protocols, and services on the system
• mechanisms implementing review and disabling of functions, ports, protocols, and/or services

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final