CM.L2-3.4.6  

Reference: CMMC 2.0

Family: CM

Level Introduced: 2

Title: Least Functionality

Practice:
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

CMMC Clarification:
You should customize organizational systems. To do this, remove non-essential applications and disable services not needed. Systems come with many unnecessary applications and settings enabled by default. Disable unnecessary software and services. These include unused ports and protocols. Leave only the fewest capabilities necessary for the systems to operate effectively.

Example
You know that systems often include unnecessary software and services enabled by default. You deploy new servers in your organization's IT environment. Before you do so, you review each system's role and minimum required capabilities. You remove software that is not needed. You disable unused ports and services. You leave only the essential capabilities enabled for the system to function in its role.

Source: CMMC v2.0