NIST Special Publication 800-171 Revision 2

Date Published: January 28th, 2021

Withdrawn on May 14, 2024. Superseded by SP 800-171 Rev. 3

Author(s): Ron Ross (NIST), Victoria Pillitteri (NIST), Kelley Dempsey (NIST), Mark Riddle (NARA), Gary Guissanie (IDA)

Note: A Class Deviation is in effect as of May 2, 2024 (DEVIATION 2024O0013). The deviation clause requires contractors, who are subject to 252.204-7012, to comply with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2, instead of the version of NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the contracting officer. Click Here

3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

Control Family: Configuration Management

Control Type: Derived

SPRS Value: 5

SPRS Supplemental Guidance: N/A

CMMC Level(s): CM.L2-3.4.6

Top Ten Failed Requirement: No

DIBCAC HIGH Failure Rate (OTS):

82nd of 110

Referenced in:

DFARS 252.204-7012

Derived From: NIST SP 800-53r4

  • CM-7

NIST Supplemental Guidance:

N/A

CSF v1.1:

  • PR.IP-1

  • PR.PT-3

NIST SP 800-171r2 Control 3.4.6 → MITRE ATT&CK 14.1

NIST SP 800-171r2 Control 3.4.6 → MITRE ATT&CK 14.1

Mapping note: MITRE ATT&CK 14.1 techniques are derived through the NIST SP 800-53 Rev. 4 controls mapped to each NIST SP 800-171 Rev. 2 requirement.

Summary

  • Total mappings: 207
  • Families: 1
  • Outer ring: Technique ID + name
  • MITRE ATT&CK version: 14.1

Family counts

  • Least Functionality: 207 techniques

Usage notes

  • Click a family or technique to zoom in.
  • Click the center to zoom back out.
  • Hover to view technique details.

Discussion:

Systems can provide a wide variety of functions and services. Some of the functions and services routinely provided by default, may not be necessary to support essential organizational missions, functions, or operations. It is sometimes convenient to provide multiple services from single system components. However, doing so increases risk over limiting the services provided by any one component. Where feasible, organizations limit component functionality to a single function per component.

Organizations review functions and services provided by systems or components of systems, to determine which functions and services are candidates for elimination. Organizations disable unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of devices, transfer of information, and tunneling. Organizations can utilize network scanning tools, intrusion detection and prevention systems, and end-point protections such as firewalls and host-based intrusion detection systems to identify and prevent the use of prohibited functions, ports, protocols, and services.

Determining Statements (NIST SP 800-171Ar2)

3.4.6[a] essential system capabilities are defined based on the principle of least
functionality.
3.4.6[b] the system is configured to provide only the defined essential capabilities

Assessors are instructed to-

Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing least functionality in the system; system security plan; system design documentation; system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].

Interview: [SELECT FROM: Personnel with security configuration management responsibilities; personnel with information security responsibilities; system or network administrators].

Test: [SELECT FROM: Organizational processes prohibiting or restricting functions, ports, protocols, or services; mechanisms implementing restrictions or prohibition of functions, ports, protocols, or services].

FURTHER DISCUSSION

You should customize organizational systems to remove non-essential applications and disable unnecessary services. Systems come with many unnecessary applications and settings enabled by default including unused ports and protocols. Leave only the fewest capabilities necessary for the systems to operate effectively.

Example

You have ordered a new server, which has arrived with a number of free utilities installed in addition to the operating system. Before you deploy the server, you research the utilities to determine which ones can be eliminated without impacting functionality. You remove the unneeded software, then move on to disable unused ports and services. The server that enters production therefore has only the essential capabilities enabled for the system to function in its role [a,b].

Potential Assessment Considerations

  • Are the roles and functions for each system identified along with the software and services required to perform those functions [a]?

  • Are the software and services required for those defined functions identified [a]?

  • Is the information system configured to exclude any function not needed in the operational environment [b]?

ISO/IEC 27001:2013

A.12.5.1* Installation of software on operational systems

NIST SP 800-171r2 Control 3.4.6 → MITRE ATT&CK
MITRE ATT&CK v14.1

NIST SP 800-171r2 Control 3.4.6 → MITRE ATT&CK

Total Mappings

207
technique references

Families

1
Least Functionality

Control

3.4.6
CM.L2-3.4.6

Least Functionality 207 techniques

  • T1003OS Credential Dumping
  • T1003.001LSASS Memory
  • T1003.002Security Account Manager
  • T1003.005Cached Domain Credentials
  • T1008Fallback Channels
  • T1011Exfiltration Over Other Network Medium
  • T1011.001Exfiltration Over Bluetooth
  • T1021.001Remote Desktop Protocol
  • T1021.002SMB/Windows Admin Shares
  • T1021.003Distributed Component Object Model
  • T1021.005VNC
  • T1021.006Windows Remote Management
  • T1036Masquerading
  • T1036.005Match Legitimate Name or Location
  • T1036.007Double File Extension
  • T1037Boot or Logon Initialization Scripts
  • T1037.001Logon Script (Windows)
  • T1046Network Service Scanning
  • T1047Windows Management Instrumentation
  • T1048Exfiltration Over Alternative Protocol
  • T1048.001Exfiltration Over Symmetric Encrypted Non-C2 Protocol
  • T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
  • T1048.003Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
  • T1052Exfiltration Over Physical Medium
  • T1052.001Exfiltration over USB
  • T1053Scheduled Task/Job
  • T1053.002At (Windows)
  • T1053.005Scheduled Task
  • T1059Command and Scripting Interpreter
  • T1059.001PowerShell
  • T1059.002AppleScript
  • T1059.003Windows Command Shell
  • T1059.004Unix Shell
  • T1059.005Visual Basic
  • T1059.006Python
  • T1059.007JavaScript
  • T1059.008Network Device CLI
  • T1068Exploitation for Privilege Escalation
  • T1071Application Layer Protocol
  • T1071.001Web Protocols
  • T1071.002File Transfer Protocols
  • T1071.003Mail Protocols
  • T1071.004DNS
  • T1072Software Deployment Tools
  • T1080Taint Shared Content
  • T1087Account Discovery
  • T1087.001Local Account
  • T1087.002Domain Account
  • T1090Proxy
  • T1090.001Internal Proxy
  • T1090.002External Proxy
  • T1090.003Multi-hop Proxy
  • T1092Communication Through Removable Media
  • T1095Non-Application Layer Protocol
  • T1098Account Manipulation
  • T1098.001Additional Cloud Credentials
  • T1098.004SSH Authorized Keys
  • T1102Web Service
  • T1102.001Dead Drop Resolver
  • T1102.002Bidirectional Communication
  • T1102.003One-Way Communication
  • T1104Multi-Stage Channels
  • T1105Ingress Tool Transfer
  • T1106Native API
  • T1112Modify Registry
  • T1127Trusted Developer Utilities Proxy Execution
  • T1129Shared Modules
  • T1133External Remote Services
  • T1135Network Share Discovery
  • T1136Create Account
  • T1136.002Domain Account
  • T1136.003Cloud Account
  • T1176Browser Extensions
  • T1187Forced Authentication
  • T1190Exploit Public-Facing Application
  • T1195Supply Chain Compromise
  • T1195.001Compromise Software Dependencies and Development Tools
  • T1195.002Compromise Software Supply Chain
  • T1197BITS Jobs
  • T1199Trusted Relationship
  • T1204User Execution
  • T1204.001Malicious Link
  • T1204.002Malicious File
  • T1204.003Malicious Image
  • T1205Traffic Signaling
  • T1205.001Port Knocking
  • T1210Exploitation of Remote Services
  • T1213Data from Information Repositories
  • T1213.001Confluence
  • T1213.002Sharepoint
  • T1216Signed Script Proxy Execution
  • T1216.001PubPrn
  • T1218Signed Binary Proxy Execution
  • T1218.001Compiled HTML File
  • T1218.002Control Panel
  • T1218.003CMSTP
  • T1218.004InstallUtil
  • T1218.005Mshta
  • T1218.007Msiexec
  • T1218.008Odbcconf
  • T1218.009Regsvcs/Regasm
  • T1218.012Verclsid
  • T1218.013Mavinject
  • T1218.014MMC
  • T1219Remote Access Software
  • T1220XSL Script Processing
  • T1221Template Injection
  • T1482Domain Trust Discovery
  • T1484Domain Policy Modification
  • T1489Service Stop
  • T1490Inhibit System Recovery
  • T1498Network Denial of Service
  • T1498.001Direct Network Flood
  • T1498.002Reflection Amplification
  • T1499Endpoint Denial of Service
  • T1499.001OS Exhaustion Flood
  • T1499.002Service Exhaustion Flood
  • T1499.003Application Exhaustion Flood
  • T1499.004Application or System Exploitation
  • T1505.004IIS Components
  • T1525Implant Internal Image
  • T1530Data from Cloud Storage Object
  • T1537Transfer Data to Cloud Account
  • T1542.004ROMMONkit
  • T1542.005TFTP Boot
  • T1543Create or Modify System Process
  • T1543.003Windows Service
  • T1543.004Launch Daemon
  • T1546.002Screensaver
  • T1546.006LC_LOAD_DYLIB Addition
  • T1546.008Accessibility Features
  • T1546.009AppCert DLLs
  • T1547.004Winlogon Helper DLL
  • T1547.006Kernel Modules and Extensions
  • T1547.007Re-opened Applications
  • T1548Abuse Elevation Control Mechanism
  • T1548.001Setuid and Setgid
  • T1548.003Sudo and Sudo Caching
  • T1548.004Elevated Execution with Prompt
  • T1552Unsecured Credentials
  • T1552.003Bash History
  • T1552.005Cloud Instance Metadata API
  • T1552.007Container API
  • T1553Subvert Trust Controls
  • T1553.001Gatekeeper Bypass
  • T1553.003SIP and Trust Provider Hijacking
  • T1553.004Install Root Certificate
  • T1553.005Mark-of-the-Web Bypass
  • T1553.006Code Signing Policy Modification
  • T1555.004Windows Credential Manager
  • T1556Modify Authentication Process
  • T1556.002Password Filter DLL
  • T1557Adversary-in-the-Middle
  • T1557.001LLMNR/NBT-NS Poisoning and SMB Relay
  • T1557.002ARP Cache Poisoning
  • T1557.003DHCP Spoofing
  • T1559Inter-Process Communication
  • T1559.002Dynamic Data Exchange
  • T1559.003XPC Services
  • T1562Impair Defenses
  • T1562.001Disable or Modify Tools
  • T1562.002Disable Windows Event Logging
  • T1562.003Impair Command History Logging
  • T1562.004Disable or Modify System Firewall
  • T1562.006Indicator Blocking
  • T1562.009Safe Mode Boot
  • T1563Remote Service Session Hijacking
  • T1563.001SSH Hijacking
  • T1563.002RDP Hijacking
  • T1564.002Hidden Users
  • T1564.003Hidden Window
  • T1564.006Run Virtual Instance
  • T1564.008Email Hiding Rules
  • T1564.009Resource Forking
  • T1565Data Manipulation
  • T1565.003Runtime Data Manipulation
  • T1569System Services
  • T1569.002Service Execution
  • T1570Lateral Tool Transfer
  • T1571Non-Standard Port
  • T1572Protocol Tunneling
  • T1573Encrypted Channel
  • T1573.001Symmetric Cryptography
  • T1573.002Asymmetric Cryptography
  • T1574Hijack Execution Flow
  • T1574.001DLL Search Order Hijacking
  • T1574.006Dynamic Linker Hijacking
  • T1574.007Path Interception by PATH Environment Variable
  • T1574.008Path Interception by Search Order Hijacking
  • T1574.009Path Interception by Unquoted Path
  • T1574.012COR_PROFILER
  • T1599Network Boundary Bridging
  • T1599.001Network Address Translation Traversal
  • T1601Modify System Image
  • T1601.001Patch System Image
  • T1601.002Downgrade System Image
  • T1602Data from Configuration Repository
  • T1602.001SNMP (MIB Dump)
  • T1602.002Network Device Configuration Dump
  • T1609Container Administration Command
  • T1610Deploy Container
  • T1611Escape to Host
  • T1612Build Image on Host
  • T1613Container and Resource Discovery
  • T1622Debugger Evasion
  • T1647Plist File Modification
  • T1648Serverless Execution

Frameworks & Controls