AO coverage. Addresses all fifteen Nonessential Functionality objectives by treating the five categories separately — for each of programs, functions, ports, protocols, and services we define what is essential, define what counts as nonessential use, and restrict or disable it as defined.

Programs [a][b][c]. Essential programs are the per-role manifests from the CM.L2-3.4.6 example plus the endpoint application allow-list from the CM.L2-3.4.8 example. Nonessential use is defined as anything not on those lists — explicitly including remote-support tools, personal cloud sync clients, torrent clients, and unsanctioned scripting runtimes. Enforcement is the allow-list on endpoints and manifest enforcement on servers; the named categories are additionally blocked by name so an attempted install produces a clear signal.

Functions [d][e][f]. Essential functions are recorded per system class: a file server serves SMB to enclave clients and nothing else; a build agent compiles and publishes artifacts. Nonessential functions are named — file and printer sharing on endpoints, remote registry, script execution by standard users, hypervisor management interfaces on non-hypervisors, and legacy administrative shares. Each is disabled through the baseline profile rather than left to per-host judgment.

Ports [g][h][i]. Each enclave VLAN has a documented list of permitted destination ports per source zone; everything else is denied by default at the firewall, and host firewalls deny inbound except the listed ports. Nonessential use is defined as any listening port not on the list for that role. Monthly internal scanning compares observed listeners against the list, and the automation opens a ticket per unexpected listener — that is how we find the developer test service someone left running.

Protocols [j][k][l]. Permitted protocols are enumerated with their required version or mode: SMB 3 with signing, LDAPS or StartTLS, SSH with approved key exchange and cipher lists, TLS 1.2 or higher, SNMPv3 authPriv. Nonessential and prohibited protocols are named: SMBv1, telnet, FTP, LLMNR, NetBIOS name service, NTLMv1, and plaintext LDAP binds. They are disabled at the host baseline and additionally denied at the firewall so a reintroduced service fails on the network as well as on the host.

Services [m][n][o]. Essential services are enumerated per role in the manifest; nonessential services include the print spooler on servers, Bluetooth on desktops, remote assistance, and vendor telemetry agents that are not required. Configuration management sets the intended state (disabled and, where supported, prevented from starting), and drift is corrected on the next run.

One review across all five. Quarterly, the same review pass walks each list with the role owners: what did the scans find, what did we add, what can we now remove. Firewall application-level visibility supplies the picture of what actually traversed the network, which regularly retires a rule nobody needed. New system intake requires all five lists before go-live.

Accepted gap. The vendor MES requires a legacy protocol between two of its own hosts. Those hosts sit in a dedicated micro-segment where the protocol is permitted only between the two addresses, is denied everywhere else, and is monitored; the constraint is documented with the vendor's statement and a review date.

• The five documented lists (programs, functions, ports, protocols, services) with per-role scope
• Firewall policy showing default deny and the permitted port and application set
• Baseline profile exports disabling the named nonessential functions and protocols
• Monthly scan output with the unexpected-listener tickets it generated
• Quarterly cross-list review notes, including at least one removal
• Micro-segmentation rule and vendor statement for the legacy MES protocol