NIST 800-171 Control 3.4.7: Nonessential Functionality Removal
Control 3.4.7 requires you to restrict, disable, or prevent nonessential programs, functions, ports, protocols, and services on information systems. This attack surface reduction is critical for organizations handling Controlled Unclassified Information (CUI). A disciplined approach to removing unnecessary capabilities protects against exploitation and maintains a secure, auditable infrastructure.
What this means
Nonessential functionality creates security gaps. Every enabled port, running service, and installed program represents a potential entry point for attackers. This control mandates an inventory-driven approach: identify what's necessary for business operations, document it explicitly, then disable everything else. This includes system services, network protocols, application features, and hardware capabilities. The goal is a minimal, defensible system posture where only approved functions remain active.
How to comply
- 1.Create an inventory of all programs, functions, ports, protocols, and services across your systems
- 2.Establish a whitelist of essential functionality required for business operations and compliance
- 3.Review and document the business justification for each whitelisted item
- 4.Disable or remove all nonessential items from systems (ports, services, protocols, applications)
- 5.Configure systems to prevent unauthorized installation or activation of nonessential functionality
- 6.Implement monitoring to detect attempts to enable disabled features
- 7.Conduct periodic reviews (at least annually) to reassess necessity and remove previously approved items if no longer needed
- 8.Maintain change logs documenting when and why functionality is removed or disabled
Evidence auditors look for
- System hardening documentation listing enabled vs. disabled ports and services by system type
- Service inventory spreadsheet with justification and approval for each active service
- Network firewall rules showing only necessary protocols enabled
- Configuration management baseline documents reflecting approved minimal configurations
- Audit logs showing disabled services and failed attempts to activate unauthorized features
- Annual functionality review records with sign-off from system owners
- Host-based firewall rules blocking unnecessary inbound/outbound connections
- Application whitelisting or blacklisting policies restricting program execution
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates system discovery and service inventory across your infrastructure, flags enabled services against your documented whitelist, and generates compliance evidence for 3.4.7 reviews—eliminating manual auditing and keeping your baseline current.
See how GRCWatch handles this control automatically
Start free trial