Frameworks / NIST SP 800-53 Rev 5 / NIST800-CM-7 NIST SP 800-53 Rev 5
CM - Configuration Management
NIST SP 800-53 Rev 5 NIST800-CM-7: CM-7 Least Functionality a. Configure the system to provide only [Assignment: organization-defined mission essential capabilities]; and b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 96 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CIS-12.1 Ensure Network Infrastructure is Up-to-Date CIS-16.7 Use Standard Hardening Configuration Templates for Application Infrastructure CIS-2.2 Ensure Authorized Software is Currently Supported CIS-2.3 Address Unauthorized Software CIS-2.5 Allowlist Authorized Software CIS-2.6 Allowlist Authorized Libraries CIS-2.7 Allowlist Authorized Scripts CIS-4.4 Implement and Manage a Firewall on Servers CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS-7.4 Perform Automated Application Patch Management CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients 1.2.5 1.2.5 Allowed services, protocols and ports justified 1.2.6 1.2.6 Security features for insecure services in use 1.3.2 1.3.2 Outbound CDE traffic restricted 2.2.1 2.2.1 System configuration standards maintained 2.2.3 2.2.3 Primary functions with different security levels managed 2.2.4 2.2.4 Only necessary functionality enabled 2.2.5 2.2.5 Insecure services, protocols or daemons secured 6.5.6 6.5.6 Remove test data and accounts before production 9.4.4 9.4.4 Management approval for media leaving facility 5.2.3 5.2.3 Periodic evaluation of components not at risk from malware 8.6.2 8.6.2 No hard-coded passwords for interactive system accounts E8-APP-ML1 Application Control (ML1) E8-APP-ML2 Application Control (ML2) E8-APP-ML3 Application Control (ML3) E8-MACRO-ML1 Configure Microsoft Office Macro Settings (ML1) E8-MACRO-ML2 Configure Microsoft Office Macro Settings (ML2) E8-MACRO-ML3 Configure Microsoft Office Macro Settings (ML3) E8-UAH-ML1 User Application Hardening - Maturity Level 1 E8-UAH-ML2 User Application Hardening - Maturity Level 2 E8-UAH-ML3 User Application Hardening - Maturity Level 3 CM-2(2) Automation Support for Accuracy and Currency CM-7 Least Functionality CM-7(1) Periodic Review CM-7(2) Prevent Program Execution CM-7(5) Authorized Software Allow-by-Exception SA-9(2) Identification of Functions, Ports, Protocols, and Services CM-2(2) Automation Support for Accuracy and Currency CM-7 Least Functionality CM-7(1) Periodic Review CM-7(2) Prevent Program Execution CM-7(5) Authorized Software Allow-by-Exception SA-9(2) Identification of Functions, Ports, Protocols, and Services 8.1 User endpoint devices 8.18 Use of privileged utility programs 8.19 Installation of software on operational systems 8.31 Separation of development, test and production environments 8.9 Configuration management SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11) SOC2-CC6.1 CC6.1 Logical access security over protected information assets SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties SOC2-CC6.8 CC6.8 Preventing and detecting unauthorised or malicious software SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure ANSSI-HYG-14 Apply a Minimum Security Level Across the Whole Estate ANSSI-HYG-17 Enable and Configure the Local Firewall on Workstations ANSSI-HYG-21 Use Secure Protocols Wherever They Exist ANSSI-HYG-27 Prohibit Internet Access from Administration Workstations and Servers ASD37-01 Application control (Essential) ASD37-04 User application hardening (Essential) ASD37-10 Server application hardening (Very Good) ASD37-11 Operating system hardening (Very Good) 8.1 User end point devices 8.18 Use of privileged utility programs 8.19 Installation of software on operational systems 8.9 Configuration management AM-2 Use only approved services ASBv3-AM-5 Use only approved applications in virtual machine ASBv3-NS-8 Detect and disable insecure services and protocols SEC05-BP02 Control traffic flow within your network layers SEC06-BP02 Provision compute from hardened images C5-COS-03 Monitoring of connections in the Cloud Service Provider's network C5-OPS-23 Managing Vulnerabilities, Malfunctions and Errors - System Hardening CE-FW.4 Approve and Document Inbound Rules CE-SC.1 Remove or Disable Unused Software AUCDR-IS-5 Limit, prevent, detect and remove malware 3.5.2 3.5.2 Client-Server Interactions 6.9.5 Control of operational software 3.4.2e Automated Detection and Remediation of Unauthorized Software CM-7 CM-7 Least Functionality CM-7 CM-7 Least Functionality CM-7 CM-7 Least Functionality Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in CM - Configuration Management You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done? NIST SP 800-53 Rev 5 NIST800-CM-7 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 96 it maps to, and the evidence behind each claim, over MCP and REST.