CM.L2-3.4.7
Nonessential Functionality
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee CM.L2-3.4.7 in the reference catalog with its NIST cross-references
Official requirement
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
Assessment objectives
a. essential programs are defined;
b. the use of nonessential programs is defined;
c. the use of nonessential programs is restricted, disabled, or prevented as defined;
d. essential functions are defined;
e. the use of nonessential functions is defined;
f. the use of nonessential functions is restricted, disabled, or prevented as defined;
g. essential ports are defined;
h. the use of nonessential ports is defined;
i. the use of nonessential ports is restricted, disabled, or prevented as defined;
j. essential protocols are defined;
k. the use of nonessential protocols is defined;
l. the use of nonessential protocols is restricted, disabled, or prevented as defined;
m. essential services are defined;
n. the use of nonessential services is defined; and
o. the use of nonessential services is restricted, disabled, or prevented as defined.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Restrict or disable nonessential programs, functions, ports, protocols, and services.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are responsible for purchasing new endpoint hardware, installing organizationally required software to the hardware, and configuring the endpoint in accordance with the organization’s policy . T he organization has a system imaging capability that loads all necessary software, but it does not remove unnecessary services, eliminate the use of certain protocols, or close unused ports. After imaging the systems, you close all ports and block the use of all protocols except the following: • TCP for SSH on port 22; • SMTP on port 25; • TCP and UDP on port 53; and • HTTP and HTTPS on port 443. The use of any other ports or protocols are allowed by exception only [i,l,o].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Configuration management policy; procedures addressing least functionality in the system; configuration management plan; system security plan; system design documentation; security configuration checklists; system configuration settings and associated documentation; specifications for preventing software program execution; documented reviews of programs, functions, ports, protocols, and/or services; change control records; system audit logs and records; other relevant documents or records
Common mistakes
Disabling an unused application while overlooking its supporting service or open port.