Skip to content
ControlVerdict
Sign in
CM.L2-3.4.6CMMC Level 2Level 2

Least Functionality

Submit your own example

Practice statement

Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.4.6.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    essential system capabilities are defined based on the principle of least functionality; and

    1 example covers this

  2. [b]

    the system is configured to provide only the defined essential capabilities.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    CM.L2-3.4.6Least Functionality
    Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

    • [a]

      essential system capabilities are defined based on the principle of least functionality; and

    • [b]

      the system is configured to provide only the defined essential capabilities.

    Role-shaped images: each server role ships only the packages that role needs

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Least Functionality objectives: essential capabilities are defined per role, and systems are configured to provide only those.

    Defining essential capabilities [a]. Each role — build agent, artifact host, file service, jump host, monitoring collector — has a manifest listing the packages, services, and management agents it needs and a one-line justification for each. The manifests were built by starting from a minimal base and adding what broke, not by pruning the old golden image, which is why they are actually minimal. Anything a developer wants added goes through change review with a justification that survives the next review.

    Configuring to match [b]. Images are produced by a build pipeline from the minimal base plus the role manifest; there is no interactive image editing and no golden-image lineage left. Desktop environments, compilers on non-build roles, sample databases, default web content, and vendor telemetry agents that are not required are absent rather than installed-and-disabled. A configuration management run enforces the manifest continuously, so a package installed by hand is removed on the next pass and the removal is logged.

    Drift detection. A weekly report diffs installed packages and running services on every host against its role manifest. Unexpected entries open a ticket; the interesting cases have all been troubleshooting tools left behind after an incident, which is now a checklist item at incident close.

    Maintenance. Quarterly manifest review with the role owner, biased toward removal — each review must consider whether anything can now be dropped. After a major OS release, the base image is rebuilt from minimal rather than upgraded in place.

    Accepted gap. The vendor MES server requires a graphical desktop and a bundled runtime we would not otherwise install. It is on its own VLAN, its extra components are documented in the manifest with the vendor requirement cited, and it is excluded from the build-farm role manifests so the exception cannot spread.

    What the evidence looks like

    • Role manifests with per-item justification
    • Image build pipeline definition showing the minimal base
    • Weekly package and service drift report with a resulting ticket
    • Configuration management run log showing removal of a hand-installed package
    • MES exception entry citing the vendor requirement

    Environment

    Linux-heavy build farm plus Windows file services. Images were previously cloned from one fat golden VM that accumulated every tool anyone ever needed.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.