NIST Special Publication 800-171 Revision 2

Date Published: January 28th, 2021

Withdrawn on May 14, 2024. Superseded by SP 800-171 Rev. 3

Author(s): Ron Ross (NIST), Victoria Pillitteri (NIST), Kelley Dempsey (NIST), Mark Riddle (NARA), Gary Guissanie (IDA)

Note: A Class Deviation is in effect as of May 2, 2024 (DEVIATION 2024O0013). The deviation clause requires contractors, who are subject to 252.204-7012, to comply with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2, instead of the version of NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the contracting officer. Click Here

3.4.7 Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

Control Family: Configuration Management

Control Type: Derived

SPRS Value: 5

SPRS Supplemental Guidance: N/A

CMMC Level(s):

CM.L2-3.4.7

DIBCAC HIGH Failure Rate (OTS):

11th of 110

Referenced in:

DFARS 252.204-7012

Derived From: NIST SP 800-53r4

  • CM-7(1)

  • CM-7(2)

NIST Supplemental Guidance:

N/A

CSF v1.1:

  • PR.IP-1

  • PR.PT-3

NIST SP 800-171r2 Control 3.4.7 → MITRE ATT&CK 14.1

NIST SP 800-171r2 Control 3.4.7 → MITRE ATT&CK 14.1

Mapping note: MITRE ATT&CK 14.1 techniques are derived through the NIST SP 800-53 Rev. 4 controls mapped to each NIST SP 800-171 Rev. 2 requirement.

Summary

  • Total mappings: 207
  • Families: 1
  • Outer ring: Technique ID + name
  • MITRE ATT&CK version: 14.1

Family counts

  • Least Functionality: 207 techniques

Usage notes

  • Click a family or technique to zoom in.
  • Click the center to zoom back out.
  • Hover to view technique details.

Discussion:

Restricting the use of nonessential software (programs) includes restricting the roles allowed to approve program execution; prohibiting auto-execute; program blacklisting and whitelisting; or restricting the number of program instances executed at the same time. The organization makes a security-based determination which functions, ports, protocols, and/or services are restricted. Bluetooth, File Transfer Protocol (FTP), and peer-to-peer networking are examples of protocols organizations consider preventing the use of, restricting, or disabling.

Determining Statements (NIST SP 800-171Ar2)

3.4.7[a] essential programs are defined.
3.4.7[b] the use of nonessential programs is defined.
3.4.7[c] the use of nonessential programs is restricted, disabled, or prevented as
defined.
3.4.7[d] essential functions are defined.
3.4.7[e] the use of nonessential functions is defined.
3.4.7[f] the use of nonessential functions is restricted, disabled, or prevented as
defined.
3.4.7[g] essential ports are defined.
3.4.7[h] the use of nonessential ports is defined.
3.4.7[i] the use of nonessential ports is restricted, disabled, or prevented as defined.
3.4.7[j] essential protocols are defined.
3.4.7[k] the use of nonessential protocols is defined.
3.4.7[l] the use of nonessential protocols is restricted, disabled, or prevented as
defined.
3.4.7[m] essential services are defined.
3.4.7[n] the use of nonessential services is defined.
3.4.7[o] the use of nonessential services is restricted, disabled, or prevented as defined.

Assessors are instructed to-

Examine: [SELECT FROM: Configuration management policy; procedures addressing least functionality in the system; configuration management plan; system security plan; system design documentation; security configuration checklists; system configuration settings and associated documentation; specifications for preventing software program execution; documented reviews of programs, functions, ports, protocols, and/or services; change control records; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: Personnel with responsibilities for reviewing programs, functions, ports, protocols, and services on the system; personnel with information security responsibilities; system or network administrators; system developers].

Test: [SELECT FROM: Organizational processes for reviewing and disabling nonessential programs, functions, ports, protocols, or services; mechanisms implementing review and handling of nonessential programs, functions, ports, protocols, or services; organizational processes preventing program execution on the system; organizational processes for software program usage and restrictions; mechanisms supporting or implementing software program usage and restrictions; mechanisms preventing program execution on the system].

FURTHER DISCUSSION

Organizations should only use the minimum set of programs, services, ports, and protocols required for to accomplish the organization’s mission. This has several implications:

  • All unnecessary programs and accounts are removed from all endpoints and servers.

  • The organization makes a policy decision to control the execution of programs through either whitelisting or blacklisting. Whitelisting means a program can only run if the software has been vetted in some way, and the executable name has been entered onto a list of allowed software. Blacklisting means any software can execute as long it is not on a list of known malicious software. Whitelisting provides far more security than blacklisting, but the organization’s policy can direct the implementation of either approach. Control of execution applies to both servers and endpoints.

  • The organization restricts the use of all unnecessary ports, protocols, and system services in order to limit entry points that attackers can use. For example, the use of the FTP service is eliminated from all computers, and the associated ports are blocked unless a required service utilizes those ports. The elimination of nonessential functionality on the network and systems provides a smaller attack surface for an attacker to gain access and take control of your network or systems.

This requirement, CM.L2-3.4.7, which requires limiting functionality to essential programs, ports, protocols, and services, extends CM.L2-3.4.6, which requires adherence to the 93 NIST SP 800-171 Rev. 2, pp. 22-23. CM.L2-3.4.7 – Nonessential Functionality CMMC Assessment Guide – Level 2 | Version 2.13 107 principle of least functionality but does not specifically address which elements of a system should be limited.

Example

You are responsible for purchasing new endpoint hardware, installing organizationally required software to the hardware, and configuring the endpoint in accordance with the organization’s policy. The organization has a system imaging capability that loads all necessary software, but it does not remove unnecessary services, eliminate the use of certain protocols, or close unused ports. After imaging the systems, you close all ports and block the use of all protocols except the following: • TCP for SSH on port 22; • SMTP on port 25; • TCP and UDP on port 53; and • HTTP and HTTPS on port 443. The use of any other ports or protocols are allowed by exception only [i,l,o].

Potential Assessment Considerations

  • Are only applications and services that are needed for the function of the system configured and enabled [a,b,c,d,e,f]?

  • Are only those ports and protocols necessary to provide the service of the information system configured for that system [g,h,i,j,k,l]?

  • Are systems services reviewed to determine what is essential for the function of that system [m]?

ISO/IEC 27001:2013

No direct mapping

NIST SP 800-171r2 Control 3.4.7 → MITRE ATT&CK
MITRE ATT&CK v14.1

NIST SP 800-171r2 Control 3.4.7 → MITRE ATT&CK

Total Mappings

207
technique references

Families

1
Least Functionality

Control

3.4.7
CM.L2-3.4.7

Least Functionality 207 techniques

  • T1003OS Credential Dumping
  • T1003.001LSASS Memory
  • T1003.002Security Account Manager
  • T1003.005Cached Domain Credentials
  • T1008Fallback Channels
  • T1011Exfiltration Over Other Network Medium
  • T1011.001Exfiltration Over Bluetooth
  • T1021.001Remote Desktop Protocol
  • T1021.002SMB/Windows Admin Shares
  • T1021.003Distributed Component Object Model
  • T1021.005VNC
  • T1021.006Windows Remote Management
  • T1036Masquerading
  • T1036.005Match Legitimate Name or Location
  • T1036.007Double File Extension
  • T1037Boot or Logon Initialization Scripts
  • T1037.001Logon Script (Windows)
  • T1046Network Service Scanning
  • T1047Windows Management Instrumentation
  • T1048Exfiltration Over Alternative Protocol
  • T1048.001Exfiltration Over Symmetric Encrypted Non-C2 Protocol
  • T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
  • T1048.003Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
  • T1052Exfiltration Over Physical Medium
  • T1052.001Exfiltration over USB
  • T1053Scheduled Task/Job
  • T1053.002At (Windows)
  • T1053.005Scheduled Task
  • T1059Command and Scripting Interpreter
  • T1059.001PowerShell
  • T1059.002AppleScript
  • T1059.003Windows Command Shell
  • T1059.004Unix Shell
  • T1059.005Visual Basic
  • T1059.006Python
  • T1059.007JavaScript
  • T1059.008Network Device CLI
  • T1068Exploitation for Privilege Escalation
  • T1071Application Layer Protocol
  • T1071.001Web Protocols
  • T1071.002File Transfer Protocols
  • T1071.003Mail Protocols
  • T1071.004DNS
  • T1072Software Deployment Tools
  • T1080Taint Shared Content
  • T1087Account Discovery
  • T1087.001Local Account
  • T1087.002Domain Account
  • T1090Proxy
  • T1090.001Internal Proxy
  • T1090.002External Proxy
  • T1090.003Multi-hop Proxy
  • T1092Communication Through Removable Media
  • T1095Non-Application Layer Protocol
  • T1098Account Manipulation
  • T1098.001Additional Cloud Credentials
  • T1098.004SSH Authorized Keys
  • T1102Web Service
  • T1102.001Dead Drop Resolver
  • T1102.002Bidirectional Communication
  • T1102.003One-Way Communication
  • T1104Multi-Stage Channels
  • T1105Ingress Tool Transfer
  • T1106Native API
  • T1112Modify Registry
  • T1127Trusted Developer Utilities Proxy Execution
  • T1129Shared Modules
  • T1133External Remote Services
  • T1135Network Share Discovery
  • T1136Create Account
  • T1136.002Domain Account
  • T1136.003Cloud Account
  • T1176Browser Extensions
  • T1187Forced Authentication
  • T1190Exploit Public-Facing Application
  • T1195Supply Chain Compromise
  • T1195.001Compromise Software Dependencies and Development Tools
  • T1195.002Compromise Software Supply Chain
  • T1197BITS Jobs
  • T1199Trusted Relationship
  • T1204User Execution
  • T1204.001Malicious Link
  • T1204.002Malicious File
  • T1204.003Malicious Image
  • T1205Traffic Signaling
  • T1205.001Port Knocking
  • T1210Exploitation of Remote Services
  • T1213Data from Information Repositories
  • T1213.001Confluence
  • T1213.002Sharepoint
  • T1216Signed Script Proxy Execution
  • T1216.001PubPrn
  • T1218Signed Binary Proxy Execution
  • T1218.001Compiled HTML File
  • T1218.002Control Panel
  • T1218.003CMSTP
  • T1218.004InstallUtil
  • T1218.005Mshta
  • T1218.007Msiexec
  • T1218.008Odbcconf
  • T1218.009Regsvcs/Regasm
  • T1218.012Verclsid
  • T1218.013Mavinject
  • T1218.014MMC
  • T1219Remote Access Software
  • T1220XSL Script Processing
  • T1221Template Injection
  • T1482Domain Trust Discovery
  • T1484Domain Policy Modification
  • T1489Service Stop
  • T1490Inhibit System Recovery
  • T1498Network Denial of Service
  • T1498.001Direct Network Flood
  • T1498.002Reflection Amplification
  • T1499Endpoint Denial of Service
  • T1499.001OS Exhaustion Flood
  • T1499.002Service Exhaustion Flood
  • T1499.003Application Exhaustion Flood
  • T1499.004Application or System Exploitation
  • T1505.004IIS Components
  • T1525Implant Internal Image
  • T1530Data from Cloud Storage Object
  • T1537Transfer Data to Cloud Account
  • T1542.004ROMMONkit
  • T1542.005TFTP Boot
  • T1543Create or Modify System Process
  • T1543.003Windows Service
  • T1543.004Launch Daemon
  • T1546.002Screensaver
  • T1546.006LC_LOAD_DYLIB Addition
  • T1546.008Accessibility Features
  • T1546.009AppCert DLLs
  • T1547.004Winlogon Helper DLL
  • T1547.006Kernel Modules and Extensions
  • T1547.007Re-opened Applications
  • T1548Abuse Elevation Control Mechanism
  • T1548.001Setuid and Setgid
  • T1548.003Sudo and Sudo Caching
  • T1548.004Elevated Execution with Prompt
  • T1552Unsecured Credentials
  • T1552.003Bash History
  • T1552.005Cloud Instance Metadata API
  • T1552.007Container API
  • T1553Subvert Trust Controls
  • T1553.001Gatekeeper Bypass
  • T1553.003SIP and Trust Provider Hijacking
  • T1553.004Install Root Certificate
  • T1553.005Mark-of-the-Web Bypass
  • T1553.006Code Signing Policy Modification
  • T1555.004Windows Credential Manager
  • T1556Modify Authentication Process
  • T1556.002Password Filter DLL
  • T1557Adversary-in-the-Middle
  • T1557.001LLMNR/NBT-NS Poisoning and SMB Relay
  • T1557.002ARP Cache Poisoning
  • T1557.003DHCP Spoofing
  • T1559Inter-Process Communication
  • T1559.002Dynamic Data Exchange
  • T1559.003XPC Services
  • T1562Impair Defenses
  • T1562.001Disable or Modify Tools
  • T1562.002Disable Windows Event Logging
  • T1562.003Impair Command History Logging
  • T1562.004Disable or Modify System Firewall
  • T1562.006Indicator Blocking
  • T1562.009Safe Mode Boot
  • T1563Remote Service Session Hijacking
  • T1563.001SSH Hijacking
  • T1563.002RDP Hijacking
  • T1564.002Hidden Users
  • T1564.003Hidden Window
  • T1564.006Run Virtual Instance
  • T1564.008Email Hiding Rules
  • T1564.009Resource Forking
  • T1565Data Manipulation
  • T1565.003Runtime Data Manipulation
  • T1569System Services
  • T1569.002Service Execution
  • T1570Lateral Tool Transfer
  • T1571Non-Standard Port
  • T1572Protocol Tunneling
  • T1573Encrypted Channel
  • T1573.001Symmetric Cryptography
  • T1573.002Asymmetric Cryptography
  • T1574Hijack Execution Flow
  • T1574.001DLL Search Order Hijacking
  • T1574.006Dynamic Linker Hijacking
  • T1574.007Path Interception by PATH Environment Variable
  • T1574.008Path Interception by Search Order Hijacking
  • T1574.009Path Interception by Unquoted Path
  • T1574.012COR_PROFILER
  • T1599Network Boundary Bridging
  • T1599.001Network Address Translation Traversal
  • T1601Modify System Image
  • T1601.001Patch System Image
  • T1601.002Downgrade System Image
  • T1602Data from Configuration Repository
  • T1602.001SNMP (MIB Dump)
  • T1602.002Network Device Configuration Dump
  • T1609Container Administration Command
  • T1610Deploy Container
  • T1611Escape to Host
  • T1612Build Image on Host
  • T1613Container and Resource Discovery
  • T1622Debugger Evasion
  • T1647Plist File Modification
  • T1648Serverless Execution

Frameworks & Controls