What this requirement asks
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
This is a CMMC Level 2 requirement in the Configuration Management family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (15)
- 3.4.7[a] — essential programs are defined
- 3.4.7[b] — the use of nonessential programs is defined
- 3.4.7[c] — the use of nonessential programs is restricted, disabled, or prevented as defined
- 3.4.7[d] — essential functions are defined
- 3.4.7[e] — the use of nonessential functions is defined
- 3.4.7[f] — the use of nonessential functions is restricted, disabled, or prevented as defined
- 3.4.7[g] — essential ports are defined
- 3.4.7[h] — the use of nonessential ports is defined
- 3.4.7[i] — the use of nonessential ports is restricted, disabled, or prevented as defined
- 3.4.7[j] — essential protocols are defined
- 3.4.7[k] — the use of nonessential protocols is defined
- 3.4.7[l] — the use of nonessential protocols is restricted, disabled, or prevented as defined
- 3.4.7[m] — essential services are defined
- 3.4.7[n] — the use of nonessential services is defined
- 3.4.7[o] — the use of nonessential services is restricted, disabled, or prevented as defined
What an assessor examines
Examine:
- Configuration management policy
- procedures addressing least functionality in the system
- configuration management plan
- system security plan
- system design documentation
- security configuration checklists
- system configuration settings and associated documentation
- specifications for preventing software program execution
- documented reviews of programs, functions, ports, protocols, and/or services
- change control records
- system audit logs and records
- other relevant documents or records
Interview:
- Personnel with responsibilities for reviewing programs, functions, ports, protocols, and services on the system
- personnel with information security responsibilities
- system or network administrators
- system developers
Test:
- Organizational processes for reviewing and disabling nonessential programs, functions, ports, protocols, or services
- mechanisms implementing review and handling of nonessential programs, functions, ports, protocols, or services
- organizational processes preventing program execution on the system
- organizational processes for software program usage and restrictions
- mechanisms supporting or implementing software program usage and restrictions
- mechanisms preventing program execution on the system
Evidence that defends it
Show AppLocker/allowlist configs
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.