[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fcm-7":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","cm-7","CM-7","Least Functionality",279,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Systems must be configured to provide only essential capabilities, and unnecessary functions, ports, protocols, software and services must be prohibited or restricted.\n\n**In practice.** Doing this well means removing or disabling unused services and software at build time, closing unneeded ports, and using application allowlisting where feasible. Periodic reviews identify functions that have become unnecessary. Auditors look for hardened build standards, port and service scans, allowlisting policies and records of review. The idea also appears in CIS Controls 2 and 4.\n\n**Common gaps.** Default installations often bring unneeded services that are never removed. Legacy protocols such as SMBv1 or unencrypted management interfaces tend to linger long after they stop being required. Nobody may own the job of reviewing whether enabled functions are still needed.","a. Configure the system to provide only [Assignment: organization-defined mission-essential capabilities] ; and\n  b. Prohibit or restrict the use of the following functions, ports, protocols, software, and\u002For services: [Assignment: organization-defined organization-defined prohibited or restricted functions, system ports, protocols, software, and\u002For services].\nDiscussion: Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality can also be achieved as part of the fundamental design and development of the system (see [SA-8](#sa-8), [SC-2](#sc-2) , and [SC-3](#sc-3)).","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"fake-ai-brand-impersonation-campaigns-target-enterprise-developers","Fake AI Brand Impersonation Campaigns Target Enterprise Developers","2026-10-16T22:20:50.472+00:00",{"slug":25,"title":26,"published_at":27},"claude-code-desktop-flaw-enabled-html-based-credential-theft","Claude Code Desktop Flaw Enabled HTML-Based Credential Theft","2026-10-16T18:20:18.997+00:00",{"slug":29,"title":30,"published_at":31},"malicious-aur-packages-execute-root-level-malware-via-typosquatting","Malicious AUR Packages Execute Root-Level Malware via Typosquatting","2026-10-15T18:20:20.988+00:00",{"slug":33,"title":34,"published_at":35},"pythons-new-startup-files-reduce-but-dont-eliminate-supply-chain-risk","Python's New Startup Files Reduce But Don't Eliminate Supply Chain Risk","2026-10-15T16:21:36.544+00:00",{"slug":37,"title":38,"published_at":39},"drupal-critical-rce-flaw-exploitable-without-login-via-contributed-modules","Drupal Critical RCE Flaw Exploitable Without Login via Contributed Modules","2026-10-15T14:20:53.999+00:00",{"slug":41,"title":42,"published_at":43},"critical-pan-os-rce-flaw-exploited-in-the-wild-patch-immediately","Critical PAN-OS RCE Flaw Exploited in the Wild — Patch Immediately","2026-10-15T08:21:02.348+00:00",{"slug":45,"title":46,"published_at":47},"record-1411-vulnerabilities-patched-including-3-zero-days-in-microsoft-october-2026-patch-tuesday","Record 1,411 Vulnerabilities Patched Including 3 Zero-Days in Microsoft October 2026 Patch Tuesday","2026-10-13T20:20:18.566+00:00",{"slug":49,"title":50,"published_at":51},"anthropic-ai-models-exploit-government-sites-during-testing","Anthropic AI Models Exploit Government Sites During Testing","2026-10-12T20:20:33.279+00:00",{"slug":53,"title":54,"published_at":55},"ai-agents-exploited-via-malicious-package-supply-chain-attacks","AI Agents Exploited via Malicious Package Supply Chain Attacks","2026-10-12T13:20:21.797+00:00",{"slug":57,"title":58,"published_at":59},"fake-claude-ai-ads-trick-users-into-running-malware-via-clickfix","Fake Claude AI Ads Trick Users into Running Malware via ClickFix","2026-10-09T22:20:47.165+00:00",{"slug":61,"title":62,"published_at":63},"malicious-ide-extensions-whatsapp-rat-and-exposed-c2-infrastructure-highlight-diverse-threat-landsca","Malicious IDE Extensions, WhatsApp RAT, and Exposed C2 Infrastructure Highlight Diverse Threat Landscape","2026-10-08T20:21:52.231+00:00",{"slug":65,"title":66,"published_at":67},"swedish-dpa-fines-it-provider-160k-after-cyberattack-exposes-22-million-records","Swedish DPA Fines IT Provider €160K After Cyberattack Exposes 2.2 Million Records","2026-10-08T16:21:10.231+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",194,{"slug":75,"name":76,"problem":77,"stories":78},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",77,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",62,{"slug":85,"name":86,"problem":87,"stories":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",57,{"slug":90,"name":91,"problem":92,"stories":93},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",44,{"slug":95,"name":96,"problem":97,"stories":93},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[99,105,110,114,119,125,130,135],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","2","Control 2","Inventory and Control of Software Assets",184,{"family":5,"item":106,"code":107,"title":108,"together":109},"si-3","SI-3","Malicious Code Protection",122,{"family":100,"item":111,"code":112,"title":113,"together":109},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":100,"item":115,"code":116,"title":117,"together":118},"7","Control 7","Continuous Vulnerability Management",110,{"family":120,"item":121,"code":122,"title":123,"together":124},"gdpr","32","Article 32","Security of processing",107,{"family":126,"item":127,"code":128,"title":128,"together":129},"itil","overview","ITIL",86,{"family":5,"item":131,"code":132,"title":133,"together":134},"si-2","SI-2","Flaw Remediation",79,{"family":100,"item":136,"code":137,"title":138,"together":139},"13","Control 13","Network Monitoring and Defense",78]