💼 CM-7 Least Functionality (L)(M)(H)

• Contextual name: 💼 CM-7 Least Functionality (L)(M)(H)
• ID: /frameworks/fedramp-high-security-controls/cm/07
• Located in: 💼 Configuration Management

Description

a. Configure the system to provide only [Assignment: organization-defined mission essential capabilities]; and

b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].

CM-7 Additional FedRAMP Requirements and Guidance:

(b) Requirement: The service provider shall use Security guidelines (See CM-6) to establish list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if STIGs or CIS is not available.

Similar

• Sections
  • /frameworks/nist-sp-800-53-r5/cm/07
• Internal
  • ID: dec-c-ff33d573

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 NIST SP 800-53 Revision 5 → 💼 CM-7 Least Functionality	9		23

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 FedRAMP Low Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)			29
💼 FedRAMP Moderate Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)	3		33

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CM-7(1) Periodic Review (M)(H)		12	12
💼 CM-7(2) Prevent Program Execution (M)(H)
💼 CM-7(5) Authorized Software — Allow-by-exception (M)(H)

Policies (29)

Policy	Logic Count	Flags
📝 AWS EC2 Security Group allows public IPv4 (0.0.0.0/0) access to admin ports 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows public IPv6 (::/0) access to admin ports 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted CIFS traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted FTP traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted RPC traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted SMTP traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to MSSQL 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to MySQL 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to PostgreSQL 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted Telnet traffic 🟢	1	🟢 x6
📝 AWS RDS Instance Auto Minor Version Upgrade is not enabled 🟠🟢	1	🟠 x1, 🟢 x6
📝 AWS VPC Network ACL exposes admin ports to public internet ports 🟢	1	🟢 x6
📝 Azure App Service does not run the latest Java version 🟢		🟢 x3
📝 Azure App Service does not run the latest PHP version 🟢		🟢 x3
📝 Azure App Service does not run the latest Python version 🟢		🟢 x3
📝 Azure Network Security Group allows public access to RDP port 🟢	1	🟢 x6
📝 Azure Network Security Group allows public access to SSH port 🟢	1	🟢 x6
📝 Google Cloud DNS Managed Zone DNSSEC is not enabled 🟢	1	🟢 x6
📝 Google Cloud DNS Managed Zone DNSSEC Key-Signing Algorithm is RSASHA1 🟢	1	🟢 x6
📝 Google Cloud DNS Managed Zone DNSSEC Zone-Signing Algorithm is RSASHA1 🟢	1	🟢 x6
📝 Google Cloud MySQL Instance Local_infile Database Flag is not set to off 🟢	1	🟢 x6
📝 Google Cloud SQL Server Instance 3625 (trace flag) Database Flag is not set to on 🟢	1	🟢 x6
📝 Google Cloud SQL Server Instance external scripts enabled Database Flag is not set to off 🟢	1	🟢 x6
📝 Google Cloud SQL Server Instance remote access Database Flag is not set to off 🟢	1	🟢 x6
📝 Google Cloud SQL Server Instance user connections Database Flag is set to a limiting (other than 0) value 🟢	1	🟢 x6
📝 Google Cloud SQL Server Instance user options Database Flag is configured 🟢	1	🟢 x6
📝 Google GCE Instance Enable Connecting to Serial Ports is not disabled 🟢	1	🟢 x6
📝 Google Project has a default network 🟢	1	🟢 x6
📝 Google Project has a legacy network 🟢	1	🟢 x6

Internal Rules

Rule	Policies	Flags
✉️ dec-x-4c15a09f	1
✉️ dec-x-599c86b4	1
✉️ dec-x-879aa996	1
✉️ dec-x-215302da	1
✉️ dec-x-a20e54a0	1
✉️ dec-x-f82b9849	1