What this requirement asks
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
This is a CMMC Level 2 requirement in the Configuration Management family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (2)
- 3.4.6[a] — essential system capabilities are defined based on the principle of least functionality
- 3.4.6[b] — the system is configured to provide only the defined essential capabilities
What an assessor examines
Examine:
- Configuration management policy
- configuration management plan
- procedures addressing least functionality in the system
- system security plan
- system design documentation
- system configuration settings and associated documentation
- security configuration checklists
- other relevant documents or records
Interview:
- Personnel with security configuration management responsibilities
- personnel with information security responsibilities
- system or network administrators
Test:
- Organizational processes prohibiting or restricting functions, ports, protocols, or services
- mechanisms implementing restrictions or prohibition of functions, ports, protocols, or services
Evidence that defends it
Show hardening results and service baselines
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.