CM-7 is the attack surface control. Run only what you need, and prohibit or restrict the functions, ports, protocols, software and services you decide are risky. It is easy to state and surprisingly hard to prove, because the evidence is mostly an absence.
800-53 binds US federal systems and others by contract. For a small or mid size company it is a reference, and open port and unused service questions are staples of customer reviews and penetration test reports.
What the control asks
The statement has two parts. Configure the system to provide only the capabilities you define as essential. Prohibit or restrict the use of the functions, ports, protocols, software and services you list.
NIST's guidance notes that systems ship with many functions by default, and that combining several services on one component increases risk. Where feasible, limit a component to a single function. Remove unused software and disable unused physical and logical ports and protocols to prevent unauthorized connection, information transfer and tunneling. It names network scanning tools, intrusion detection and prevention, and endpoint protection such as firewalls and host intrusion detection as ways to identify prohibited use. It also notes that least functionality can come from system design (see SA-8, SC-2 and SC-3).
What it means in practice
Treat it as two lists. The essential list says what each system type exists to do. The prohibited list says what must not run, such as telnet, anonymous FTP, unused database ports or debug endpoints.
Containers make this easier. A minimal base image has fewer packages, fewer listening services and a smaller dependency tree. One process per container is the same single function principle in modern clothes.
Evidence to collect
- The documented essential functions for each system or image type.
- The prohibited function, port, protocol and service list.
- Firewall and security group rules showing only needed ports are open.
- Port and service scan results from the last period, with follow up.
- Base image definitions showing removed packages.
- The most recent review of the lists, which CM-7.1 calls Periodic Review.
Common gaps
- Default services left running because nobody asked.
- Test endpoints reach production.
- Egress is wide open, so tunneling is possible.
- Scans run but nobody compares the output to the allowed list.
- Dependencies bring in code that is never used, expanding attack surface at the library level.
How to implement it
Start from minimal images and add what you need. Close inbound and outbound ports by default and open them by request. Scan from outside and inside, then compare results to the lists. Review the lists twice a year.
Code level attack surface matters too. Reachability analysis shows which vulnerable functions in your dependencies your application can actually call, so you know which unused code is worth deleting rather than patching.
The enhancements describe stronger controls. CM-7.2 is Prevent Program Execution. CM-7.3 is Registration Compliance. CM-7.4 is Unauthorized Software and Deny by exception. CM-7.5 is Authorized Software and Allow by exception. CM-7.6 is Confined Environments with Limited Privileges. CM-7.7 is Code Execution in Protected Environments. CM-7.8 is Binary or Machine Executable Code. Allow by exception, an application allow list, is the strongest of the software controls and also the hardest to run.
Try it yourself
Run the free in-browser dependency scan at gold.safeguard.sh/scan on a manifest to see how many packages your project pulls in and which carry known vulnerabilities. It is a quick view of library level surface.
Quick check
What is the difference between deny by exception and allow by exception?
Deny by exception, CM-7.4, blocks listed software and allows everything else. Allow by exception, CM-7.5, permits only listed software and blocks the rest.
Is an open port scan enough evidence?
It helps, but you also need the documented list of what should be open so the scan result can be judged against it.
