Description
The organization configures the information system to provide only essential capabilities and specifically prohibits and/or restricts the use of the following functions, ports, protocols, and/or services: [Assignment: organization-defined list of prohibited and/or restricted functions, ports, protocols, and/or services].
Supplemental Guidance
Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Additionally, it is sometimes convenient to provide multiple services from a single component of an information system, but doing so increases risk over limiting the services provided by any one component. Where feasible, the organization limits component functionality to a single function per device (e.g., email server or web server, not both). The functions and services provided by information systems, or individual components of information systems, are carefully reviewed to determine which functions and services are candidates for elimination (e.g., Voice Over Internet Protocol, Instant Messaging, File Transfer Protocol, Hyper Text Transfer Protocol, file sharing).
Changes from Rev 4
Adds parameter text for 'mission' essential capabilities Discussion expanded slightly
Enhancements
(1) The organization reviews the information system [Assignment: organization-defined frequency], to identify and eliminate unnecessary functions, ports, protocols, and/or services.
MITRE ATT&CK Techniques (225)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.
Reconnaissance 1 Initial Access 8 Execution 24 Persistence 46 Privilege Escalation 37 Defense Evasion 79 Credential Access 20 Discovery 9 Lateral Movement 14 Collection 13 Command & Control 26 Exfiltration 10 Impact 12
Show all 225 techniques grouped by tactic
Reconnaissance
Initial Access
Execution
T1047 Windows Management Instrumentation T1053 Scheduled Task/Job T1059 Command and Scripting Interpreter T1072 Software Deployment Tools T1106 Native API T1129 Shared Modules T1204 User Execution T1559 Inter-Process Communication T1569 System Services T1609 Container Administration Command T1610 Deploy Container T1648 Serverless Execution T1053.002 At T1053.005 Scheduled Task T1059.005 Visual Basic T1059.007 JavaScript T1059.009 Cloud API T1059.010 AutoHotKey & AutoIT T1204.001 Malicious Link T1204.002 Malicious File T1204.003 Malicious Image T1559.002 Dynamic Data Exchange T1559.003 XPC Services T1569.002 Service Execution
Persistence
T1037 Boot or Logon Initialization Scripts T1053 Scheduled Task/Job T1078 Valid Accounts T1098 Account Manipulation T1133 External Remote Services T1136 Create Account T1176 Browser Extensions T1197 BITS Jobs T1205 Traffic Signaling T1525 Implant Internal Image T1543 Create or Modify System Process T1556 Modify Authentication Process T1574 Hijack Execution Flow T1653 Power Settings T1037.001 Logon Script (Windows) T1053.002 At T1053.005 Scheduled Task T1078.004 Cloud Accounts T1098.001 Additional Cloud Credentials T1098.004 SSH Authorized Keys T1098.007 Additional Local or Domain Groups T1136.002 Domain Account T1136.003 Cloud Account T1205.001 Port Knocking T1505.004 IIS Components T1542.004 ROMMONkit T1542.005 TFTP Boot T1546.002 Screensaver T1546.006 LC_LOAD_DYLIB Addition T1546.008 Accessibility Features T1546.009 AppCert DLLs T1546.010 AppInit DLLs T1547.004 Winlogon Helper DLL T1547.006 Kernel Modules and Extensions T1547.007 Re-opened Applications T1547.009 Shortcut Modification T1556.002 Password Filter DLL T1556.008 Network Provider DLL T1556.009 Conditional Access Policies T1574.001 DLL Search Order Hijacking T1574.006 Dynamic Linker Hijacking T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.012 COR_PROFILER T1574.014 AppDomainManager
Privilege Escalation
T1037 Boot or Logon Initialization Scripts T1053 Scheduled Task/Job T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1098 Account Manipulation T1484 Domain or Tenant Policy Modification T1543 Create or Modify System Process T1548 Abuse Elevation Control Mechanism T1574 Hijack Execution Flow T1611 Escape to Host T1037.001 Logon Script (Windows) T1053.002 At T1053.005 Scheduled Task T1078.004 Cloud Accounts T1098.001 Additional Cloud Credentials T1098.004 SSH Authorized Keys T1098.007 Additional Local or Domain Groups T1546.002 Screensaver T1546.006 LC_LOAD_DYLIB Addition T1546.008 Accessibility Features T1546.009 AppCert DLLs T1546.010 AppInit DLLs T1547.004 Winlogon Helper DLL T1547.006 Kernel Modules and Extensions T1547.007 Re-opened Applications T1547.009 Shortcut Modification T1548.001 Setuid and Setgid T1548.003 Sudo and Sudo Caching T1548.004 Elevated Execution with Prompt T1548.006 TCC Manipulation T1574.001 DLL Search Order Hijacking T1574.006 Dynamic Linker Hijacking T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.012 COR_PROFILER T1574.014 AppDomainManager
Defense Evasion
T1027 Obfuscated Files or Information T1036 Masquerading T1078 Valid Accounts T1112 Modify Registry T1127 Trusted Developer Utilities Proxy Execution T1197 BITS Jobs T1205 Traffic Signaling T1216 System Script Proxy Execution T1218 System Binary Proxy Execution T1220 XSL Script Processing T1221 Template Injection T1484 Domain or Tenant Policy Modification T1548 Abuse Elevation Control Mechanism T1553 Subvert Trust Controls T1556 Modify Authentication Process T1562 Impair Defenses T1574 Hijack Execution Flow T1599 Network Boundary Bridging T1601 Modify System Image T1610 Deploy Container T1612 Build Image on Host T1622 Debugger Evasion T1647 Plist File Modification T1036.005 Match Legitimate Name or Location T1036.007 Double File Extension T1036.008 Masquerade File Type T1078.004 Cloud Accounts T1127.002 ClickOnce T1205.001 Port Knocking T1216.001 PubPrn T1216.002 SyncAppvPublishingServer T1218.001 Compiled HTML File T1218.002 Control Panel T1218.003 CMSTP T1218.004 InstallUtil T1218.005 Mshta T1218.007 Msiexec T1218.008 Odbcconf T1218.009 Regsvcs/Regasm T1218.012 Verclsid T1218.013 Mavinject T1218.014 MMC T1218.015 Electron Applications T1542.004 ROMMONkit T1542.005 TFTP Boot T1548.001 Setuid and Setgid T1548.003 Sudo and Sudo Caching T1548.004 Elevated Execution with Prompt T1548.006 TCC Manipulation T1553.001 Gatekeeper Bypass T1553.003 SIP and Trust Provider Hijacking T1553.004 Install Root Certificate T1553.005 Mark-of-the-Web Bypass T1553.006 Code Signing Policy Modification T1556.002 Password Filter DLL T1556.008 Network Provider DLL T1556.009 Conditional Access Policies T1562.001 Disable or Modify Tools T1562.002 Disable Windows Event Logging T1562.003 Impair Command History Logging T1562.004 Disable or Modify System Firewall T1562.006 Indicator Blocking T1562.009 Safe Mode Boot T1562.010 Downgrade Attack T1564.002 Hidden Users T1564.003 Hidden Window T1564.006 Run Virtual Instance T1564.008 Email Hiding Rules T1564.009 Resource Forking T1574.001 DLL Search Order Hijacking T1574.006 Dynamic Linker Hijacking T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.012 COR_PROFILER T1574.014 AppDomainManager T1599.001 Network Address Translation Traversal T1601.001 Patch System Image T1601.002 Downgrade System Image
Credential Access
T1003 OS Credential Dumping T1040 Network Sniffing T1187 Forced Authentication T1552 Unsecured Credentials T1556 Modify Authentication Process T1557 Adversary-in-the-Middle T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.005 Cached Domain Credentials T1552.003 Bash History T1552.005 Cloud Instance Metadata API T1552.007 Container API T1555.004 Windows Credential Manager T1555.006 Cloud Secrets Management Stores T1556.002 Password Filter DLL T1556.008 Network Provider DLL T1556.009 Conditional Access Policies T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay T1557.002 ARP Cache Poisoning T1557.003 DHCP Spoofing
Discovery
Lateral Movement
T1021 Remote Services T1072 Software Deployment Tools T1080 Taint Shared Content T1210 Exploitation of Remote Services T1563 Remote Service Session Hijacking T1570 Lateral Tool Transfer T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.003 Distributed Component Object Model T1021.005 VNC T1021.006 Windows Remote Management T1021.008 Direct Cloud VM Connections T1563.001 SSH Hijacking T1563.002 RDP Hijacking
Collection
T1213 Data from Information Repositories T1530 Data from Cloud Storage T1557 Adversary-in-the-Middle T1602 Data from Configuration Repository T1213.001 Confluence T1213.002 Sharepoint T1213.004 Customer Relationship Management Software T1213.005 Messaging Applications T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay T1557.002 ARP Cache Poisoning T1557.003 DHCP Spoofing T1602.001 SNMP (MIB Dump) T1602.002 Network Device Configuration Dump
Command & Control
T1008 Fallback Channels T1071 Application Layer Protocol T1090 Proxy T1092 Communication Through Removable Media T1095 Non-Application Layer Protocol T1102 Web Service T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1205 Traffic Signaling T1219 Remote Access Software T1571 Non-Standard Port T1572 Protocol Tunneling T1573 Encrypted Channel T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.003 Mail Protocols T1071.004 DNS T1090.001 Internal Proxy T1090.002 External Proxy T1090.003 Multi-hop Proxy T1102.001 Dead Drop Resolver T1102.002 Bidirectional Communication T1102.003 One-Way Communication T1205.001 Port Knocking T1573.001 Symmetric Cryptography T1573.002 Asymmetric Cryptography
Exfiltration
T1011 Exfiltration Over Other Network Medium T1048 Exfiltration Over Alternative Protocol T1052 Exfiltration Over Physical Medium T1537 Transfer Data to Cloud Account T1011.001 Exfiltration Over Bluetooth T1020.001 Traffic Duplication T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1052.001 Exfiltration over USB
Impact
T1489 Service Stop T1490 Inhibit System Recovery T1498 Network Denial of Service T1499 Endpoint Denial of Service T1565 Data Manipulation T1498.001 Direct Network Flood T1498.002 Reflection Amplification T1499.001 OS Exhaustion Flood T1499.002 Service Exhaustion Flood T1499.003 Application Exhaustion Flood T1499.004 Application or System Exploitation T1565.003 Runtime Data Manipulation
Compliance Mappings
ISO 27001:2022
A.8.1A.8.18A.8.19A.8.9
ISO 27002:2022
5.378.18.188.198.9
COBIT 2019
BAI10
CIS Controls v8
CIS 10.3CIS 12CIS 2CIS 2.3CIS 2.5CIS 2.6CIS 2.7CIS 4CIS 4.8CIS 9.1CIS 9.4
NIST CSF 2.0
PR.PS-01PR.PS-02PR.PS-05
SOC 2 TSC
CC6.1-POF7CC6.7-POF1
PCI DSS v4.0.1
1.2.52.22.2.5
CSA CCM v4
UEM-02UEM-10
CSA AICM v1
UEM-02UEM-10
FINOS CCC
CCC-C14
ISO 42001:2023
A.9.4
IEC 62443
3-3 SR 7.63-3 SR 7.7
NIS2 Directive
Art. 21(2)(g)
MAS TRM
11
ASD Essential Eight
E8-1E8-1 ML1E8-1 ML2E8-1 ML3E8-3E8-3 ML1E8-3 ML2E8-3 ML3E8-4E8-4 ML1E8-4 ML2E8-4 ML3
BSI IT-Grundschutz
APP.1.1NET.1.2NET.3.1SYS.1.1SYS.2.1
ANSSI
Hygiene.18Hygiene.20SecNumCloud.13.1
FINMA Circular 2023/1
IV.A(28)IV.C(64)IV.C(65)
OSFI B-13
B-13.2.2B-13.3.2
EU GDPR
Art.25(1)Art.25(2)Art.32(1)(b)
EU DORA
Art.7(1)Art.9(1)
BIO2
5.378.18.188.198.9
RBI CSF
Annex1.2Annex1.5
FISC Security Guidelines
FISC.T14FISC.T7
MLPS 2.0
8.1.10.48.1.4.4
DNB Good Practice
DNB.13.2DNB.20.1DNB.3.2
EU CRA
CRA.I.2bCRA.I.2jCRA.Info.8e
SWIFT CSCF
SWIFT.1.1SWIFT.1.4SWIFT.2.10SWIFT.2.2SWIFT.2.3
SAMA CSF
3.33.5
NCA ECC
2-142-32-65-1
UAE IA
T7
Qatar NIA
OS
CBUAE
CR-7
CBE CSF
CTO-6CTO-7
SA JS2
JS2-7.2JS2-8.4
CBN CSF
Part3.3
BoG CISD
CISD-VI
POPIA
s19
BoM CTRM
3.123.2
CPMI-IOSCO PFMI
CG.PR
FFIEC IS
II.C.10II.C.11II.C.13(e)II.C.15(a)
ECB CROE
CROE.2.3.4
EBA ICT Guidelines
3.4.4
SEBI CSCRF
PR.ESPR.IP
BOT Cyber Resilience
Ch2.1Ch2.6
CMMC 2.0
CM
NERC CIP
CIP-005-7CIP-007-6
10 CFR 73.54
RG5.71-B-CM
IEEE 1686-2022
5.65.9
FERC CIP Orders
Order 887
DOE C2M2 v2.1
ASSET
API 1164
Sec 7
IAEA NSS 17-T
Sec 5.4
FIPS 140-3
FIPS 140-3 §7.6
Common Criteria
CC Part 2 — FMT
ISAE 3402
Clause 4
Solvency II
EIOPA-ICT-4.8
Lloyd's Minimum Standards
MS8.10MS8.4
NAIC Insurance Data Security
4-config4B
FCA SYSC 13
SYSC 13.7.1
HITRUST CSF v11
09.a
FDA 21 CFR Part 11
§11.10(f)
ISO 27799
6.3
NHS DSPT
NDG-4.4
OWASP MASVS v2.1
MASVS-PLATFORM-1MASVS-PLATFORM-2
CCSS v9.0
1.02.11.05.4
MiCA
Art.68(1)Art.62(5)
Basel SCO60
SCO60.51SCO60.64SCO60.65
BSSC Standards
NOS-03TIS-03
ISO 17799 (legacy)
None.
COBIT 4.1 (legacy)
None.