Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CM-6 (3) What is the solution and how is it implemented? Least Functionality (CM-7) The organization configures the information system to provide only essential capabilities and specifically prohibits or restricts the use of the following functions, ports, protocols, and/or services [Assignment: organization-defined list of prohibited or restricted functions, ports, protocols, and/or services] CM-7 Parameter Requirement: See additional requirements and guidance. CM-7 Additional FedRAMP Requirements and Guidance: Requirement: The service provider uses the Center for Internet Security guidelines (Level 1) to establish a list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available. The list of prohibited or restricted functions, ports, protocols, and/or services is approved and accepted by the JAB. Guidance: Information on the USGCB checklists can be found at: . CM-7 Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned
Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CM-6 (3) What is the solution and how is it implemented? Least Functionality (CM-7) The organization configures the information system to provide only essential capabilities and specifically prohibits or restricts the use of the following functions, ports, protocols, and/or services [Assignment: organization-defined list of prohibited or restricted functions, ports, protocols, and/or services] CM-7 Parameter Requirement: See additional requirements and guidance. CM-7 Additional FedRAMP Requirements and Guidance: Requirement: The service provider uses the Center for Internet Security guidelines (Level 1) to establish a list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available. The list of prohibited or restricted functions, ports, protocols, and/or services is approved and accepted by the JAB. Guidance: Information on the USGCB checklists can be found at: . CM-7 Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned
System_Security_Plan_Template_101512_508.docx