`CM-07` Least Functionality

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version

unchanged CM Low baseline Moderate baseline High baseline

Title

Least Functionality

Control

a. Configure the system to provide only [Assignment: mission-essential capabilities] ; and
b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].

Discussion

Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality can also be achieved as part of the fundamental design and development of the system (see [SA-8](#sa-8), [SC-2](#sc-2) , and [SC-3](#sc-3)).

Parameters

cm-7_prm_2: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services
cm-07_odp.01: mission-essential capabilities
cm-07_odp.02: functions
cm-07_odp.03: ports
cm-07_odp.04: protocols
cm-07_odp.05: software
cm-07_odp.06: services

Related controls

ac-3, ac-4, cm-11, cm-2, cm-5, cm-6, ra-5, sa-15, sa-4, sa-5, sa-8, sa-9, sc-2, sc-3, sc-37, sc-7, si-4

STIG rules that implement this control 353

Apple iOS/iPadOS 26 V1R3

AIOS-26-010600 CAT III Apple iOS/iPadOS 26 must implement the management setting: not allow automatic completion of Safari browser passcodes.
AIOS-26-010700 CAT II Apple iOS/iPadOS 26 must implement the management setting: encrypt backups/Encrypt local backup.
AIOS-26-010800 CAT III Apple iOS/iPadOS 26 must implement the management setting: not allow use of Handoff.
AIOS-26-010850 CAT III Apple iOS/iPadOS 26 must implement the management setting: not allow use of iPhone widgets on Mac.
AIOS-26-011200 CAT I iPhone and iPad must have the latest available iOS/iPadOS operating system installed.
AIOS-26-011800 CAT III Apple iOS/iPadOS 26 must implement the management setting: force Apple Watch wrist detection.
AIOS-26-011900 CAT II Apple iOS/iPadOS 26 users must complete required training.

Apple iOS/iPadOS 27 V1R1

AIOS-27-009800 CAT III Apple iOS/iPadOS 27 must implement the management setting: not allow automatic completion of Safari browser passcodes.
AIOS-27-009900 CAT II Apple iOS/iPadOS 27 must implement the management setting: encrypt backups/encrypt local backup.
AIOS-27-010000 CAT III Apple iOS/iPadOS 27 must implement the management setting: not allow use of Handoff.
AIOS-27-010100 CAT III Apple iOS/iPadOS 27 must implement the management setting: not allow use of iPhone widgets on Mac.
AIOS-27-010400 CAT I iPhone and iPad must have the latest available iOS/iPadOS operating system installed.
AIOS-27-011000 CAT III Apple iOS/iPadOS 27 must implement the management setting: force Apple Watch wrist detection.
AIOS-27-011100 CAT II Apple iOS/iPadOS 27 users must complete required training.

Apple macOS 15 (Sequoia) V1R8

APPL-15-002004 CAT II The macOS system must disable Location Services.
APPL-15-002005 CAT II The macOS system must disable Bonjour multicast.
APPL-15-002007 CAT II The macOS system must disable Internet Sharing.
APPL-15-002009 CAT II The macOS system must disable AirDrop.
APPL-15-002010 CAT II The macOS system must disable FaceTime.app.
APPL-15-002012 CAT II The macOS system must disable the iCloud Calendar services.
APPL-15-002013 CAT II The macOS system must disable iCloud Reminders.
APPL-15-002014 CAT II The macOS system must disable iCloud Address Book.
APPL-15-002015 CAT II The macOS system must disable iCloud Mail.
APPL-15-002016 CAT II The macOS system must disable iCloud Notes.
APPL-15-002017 CAT II The macOS system must disable the camera.
APPL-15-002020 CAT II The macOS system must disable Siri.
APPL-15-002022 CAT II The macOS system must disable Remote Apple Events.
APPL-15-002023 CAT II The macOS system must disable sending audio recordings and transcripts to Apple.
APPL-15-002024 CAT II The macOS system must disable sending search data from Spotlight to Apple.
APPL-15-002035 CAT II The macOS system must disable Apple ID setup during Setup Assistant.
APPL-15-002036 CAT II The macOS system must disable Privacy Setup services during Setup Assistant.
APPL-15-002037 CAT II The macOS system must disable iCloud storage setup during Setup Assistant.
APPL-15-002039 CAT II The macOS system must disable Siri Setup during Setup Assistant.
APPL-15-002040 CAT II The macOS system must disable iCloud Keychain Sync.
APPL-15-002041 CAT II The macOS system must disable iCloud Document Sync.
APPL-15-002042 CAT II The macOS system must disable iCloud Bookmarks.
APPL-15-002043 CAT II The macOS system must disable iCloud Photo Library.
APPL-15-002052 CAT II The macOS system must disable the System Settings pane for Wallet and Apple Pay.
APPL-15-002053 CAT II The macOS system must disable the system settings pane for Siri.
APPL-15-002080 CAT II The macOS system must disable Airplay Receiver.
APPL-15-002110 CAT II The macOS system must disable Bluetooth Sharing.
APPL-15-002120 CAT II The macOS system must disable AppleID and internet Account Modification.
APPL-15-002140 CAT II The macOS system must disable Content Caching service.
APPL-15-002150 CAT II The macOS system must disable iCloud Desktop and Document folder sync.
APPL-15-002160 CAT II The macOS system must disable iCloud Game Center.
APPL-15-002170 CAT II The macOS system must disable iCloud Private Relay.
APPL-15-002180 CAT II The macOS system must disable Find My service.
APPL-15-002200 CAT II The macOS system must disable Personalized Advertising.
APPL-15-002210 CAT II The macOS system must disable sending Siri and Dictation information to Apple.
APPL-15-002220 CAT II The macOS system must enforce On Device Dictation.
APPL-15-002230 CAT II The macOS system must disable Dictation.
APPL-15-002240 CAT II The macOS system must disable Printer Sharing.
APPL-15-002250 CAT II The macOS system must disable Remote Management.
APPL-15-002260 CAT II The macOS system must disable the Bluetooth System Settings pane.
APPL-15-002270 CAT II The macOS system must disable the iCloud Freeform services.
APPL-15-002271 CAT II The macOS system must disable iPhone Mirroring.
APPL-15-005054 CAT II The macOS system must disable the TouchID prompt during Setup Assistant.
APPL-15-005055 CAT II The macOS system must disable the Screen Time prompt during Setup Assistant.
APPL-15-005056 CAT II The macOS system must disable Unlock with Apple Watch during Setup Assistant.
APPL-15-005058 CAT II The macOS system must disable Handoff.
APPL-15-005060 CAT II The macOS system must disable proximity-based password sharing requests.
APPL-15-005061 CAT II The macOS system must disable Erase Content and Settings.
APPL-15-005140 CAT II The macOS system must disable Genmoji.
APPL-15-005150 CAT II The macOS system must disable Apple Intelligence Image Generation.
APPL-15-005160 CAT II The macOS system must disable Apple Intelligence Writing Tools.

Apple macOS 26 (Tahoe) V1R4

APPL-26-002004 CAT II The macOS system must disable Location Services.
APPL-26-002005 CAT II The macOS system must disable Bonjour multicast.
APPL-26-002007 CAT II The macOS system must disable Internet Sharing.
APPL-26-002009 CAT II The macOS system must disable AirDrop.
APPL-26-002010 CAT II The macOS system must disable FaceTime.app.
APPL-26-002012 CAT II The macOS system must disable the iCloud Calendar services.
APPL-26-002013 CAT II The macOS system must disable iCloud Reminders.
APPL-26-002014 CAT II The macOS system must disable iCloud Address Book.
APPL-26-002015 CAT II The macOS system must disable iCloud Mail.
APPL-26-002016 CAT II The macOS system must disable iCloud Notes.
APPL-26-002017 CAT II The macOS system must disable the camera.
APPL-26-002020 CAT II The macOS system must disable Siri.
APPL-26-002022 CAT II The macOS system must disable Remote Apple Events.
APPL-26-002023 CAT II The macOS system must disable sending audio recordings and transcripts to Apple.
APPL-26-002024 CAT II The macOS system must disable sending search data from Spotlight to Apple.
APPL-26-002035 CAT II The macOS system must disable Apple ID setup during Setup Assistant.
APPL-26-002036 CAT II The macOS system must disable Privacy Setup services during Setup Assistant.
APPL-26-002037 CAT II The macOS system must disable iCloud storage setup during Setup Assistant.
APPL-26-002039 CAT II The macOS system must disable Siri Setup during Setup Assistant.
APPL-26-002040 CAT II The macOS system must disable iCloud Keychain Sync.
APPL-26-002041 CAT II The macOS system must disable iCloud Document Sync.
APPL-26-002042 CAT II The macOS system must disable iCloud Bookmarks.
APPL-26-002043 CAT II The macOS system must disable iCloud Photo Library.
APPL-26-002052 CAT II The macOS system must disable the System Settings pane for Wallet and Apple Pay.
APPL-26-002053 CAT II The macOS system must disable the system settings pane for Siri.
APPL-26-002080 CAT II The macOS system must disable Airplay Receiver.
APPL-26-002110 CAT II The macOS system must disable Bluetooth Sharing.
APPL-26-002120 CAT II The macOS system must disable AppleID and internet Account Modification.
APPL-26-002140 CAT II The macOS system must disable Content Caching service.
APPL-26-002150 CAT II The macOS system must disable iCloud Desktop and Document folder sync.
APPL-26-002160 CAT II The macOS system must disable iCloud Game Center.
APPL-26-002170 CAT II The macOS system must disable iCloud Private Relay.
APPL-26-002180 CAT II The macOS system must disable Find My service.
APPL-26-002200 CAT II The macOS system must disable Personalized Advertising.
APPL-26-002210 CAT II The macOS system must disable sending Siri and Dictation information to Apple.
APPL-26-002220 CAT II The macOS system must enforce On Device Dictation.
APPL-26-002230 CAT II The macOS system must disable Dictation.
APPL-26-002240 CAT II The macOS system must disable Printer Sharing.
APPL-26-002250 CAT II The macOS system must disable Remote Management.
APPL-26-002260 CAT II The macOS system must disable the Bluetooth System Settings pane.
APPL-26-002270 CAT II The macOS system must disable the iCloud Freeform services.
APPL-26-002271 CAT II The macOS system must disable iPhone Mirroring.
APPL-26-005054 CAT II The macOS system must disable the TouchID prompt during Setup Assistant.
APPL-26-005055 CAT II The macOS system must disable the Screen Time prompt during Setup Assistant.
APPL-26-005056 CAT II The macOS system must disable Unlock with Apple Watch during Setup Assistant.
APPL-26-005058 CAT II The macOS system must disable Handoff.
APPL-26-005060 CAT II The macOS system must disable proximity-based password sharing requests.
APPL-26-005061 CAT II The macOS system must disable Erase Content and Settings.
APPL-26-005140 CAT II The macOS system must disable Genmoji AI Creation.
APPL-26-005150 CAT II The macOS system must disable Apple Intelligence Image Playground.
APPL-26-005160 CAT II The macOS system must disable Apple Intelligence Writing Tools.
APPL-26-005170 CAT II The macOS system must disable Apple Intelligence during Setup Assistant.

Application Security and Development V6R5

APSC-DV-001500 CAT II The application must be configured to disable non-essential capabilities.
APSC-DV-001510 CAT II The application must be configured to use only functions, ports, and protocols permitted to it in the PPSM CAL.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-215030 CAT I Ubuntu 22.04 LTS must not have the "rsh-server" package installed.
UBTU-22-215040 CAT II Ubuntu 22.04 LTS must not have the nfs-kernel-server package installed.
UBTU-22-251030 CAT II Ubuntu 22.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-100040 CAT I Ubuntu 24.04 LTS must not have the rsh-server package installed.
UBTU-24-100050 CAT I Ubuntu 24.04 LTS must not have the nfs-kernel-server package installed.
UBTU-24-300041 CAT II Ubuntu 24.04 LTS must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL) and vulnerability assessments.

Cisco IOS XE Router NDM Y26M04

CISC-ND-000470 CAT I The Cisco router must be configured to prohibit the use of all unnecessary and nonsecure functions and services.

Google Android 16 COBO Y26M10

GOOG-16-007400 CAT II Google Android 16 must be configured to disable developer modes.
GOOG-16-009400 CAT III Google Android 16 must be configured to disable Bluetooth or configured via User Based Enforcement (UBE) to allow Bluetooth for only Headset Profile (HSP), Hands-Free Profile (HFP), and Serial Port Profile (SPP).

Google Android 17 COBO Y26M06

GOOG-17-006400 CAT II Google Android 17 must be configured to disable developer modes.
GOOG-17-008000 CAT III Google Android 17 must be configured to disable Bluetooth or configured via User-Based Enforcement (UBE) to allow Bluetooth for only Headset Profile (HSP), Hands-Free Profile (HFP), and Serial Port Profile (SPP).

Google Chrome Current Windows V2R11

DTBC-0004 CAT II Sites ability to show pop-ups must be disabled.
DTBC-0007 CAT II The default search providers name must be set.
DTBC-0008 CAT II The default search provider URL must be set to perform encrypted searches.
DTBC-0009 CAT II Default search provider must be enabled.
DTBC-0011 CAT II The Password Manager must be disabled.
DTBC-0021 CAT II The URL protocol schema javascript must be disabled.
DTBC-0026 CAT II Metrics reporting to Google must be disabled.
DTBC-0027 CAT II Search suggestions must be disabled.
DTBC-0029 CAT II Importing of saved passwords must be disabled.
DTBC-0058 CAT II WebUSB must be disabled.
DTBC-0063 CAT II Google Cast must be disabled.
DTBC-0064 CAT II Autoplay must be disabled.
DTBC-0073 CAT II Web Bluetooth API must be disabled.

Microsoft Edge V2R5

EDGE-00-000006 CAT II Background processing must be disabled.
EDGE-00-000008 CAT II The ability of sites to show pop-ups must be disabled.
EDGE-00-000009 CAT II The default search provider must be set to use an encrypted connection.
EDGE-00-000010 CAT III Data Synchronization must be disabled.
EDGE-00-000011 CAT II Network prediction must be disabled.
EDGE-00-000012 CAT II Search suggestions must be disabled.
EDGE-00-000013 CAT II Importing of autofill form data must be disabled.
EDGE-00-000014 CAT III Importing of browser settings must be disabled.
EDGE-00-000015 CAT II Importing of cookies must be disabled.
EDGE-00-000016 CAT II Importing of extensions must be disabled.
EDGE-00-000017 CAT II Importing of browsing history must be disabled.
EDGE-00-000018 CAT II Importing of home page settings must be disabled.
EDGE-00-000019 CAT II Importing of open tabs must be disabled.
EDGE-00-000020 CAT II Importing of payment info must be disabled.
EDGE-00-000021 CAT II Importing of saved passwords must be disabled.
EDGE-00-000022 CAT II Importing of search engine settings must be disabled.
EDGE-00-000023 CAT II Importing of shortcuts must be disabled.
EDGE-00-000024 CAT II AutoplayAllowed must be set to disabled.
EDGE-00-000025 CAT II WebUSB must be disabled.
EDGE-00-000026 CAT II Google Cast must be disabled.
EDGE-00-000027 CAT II Web Bluetooth API must be disabled.
EDGE-00-000028 CAT II Autofill for Credit Cards must be disabled.
EDGE-00-000029 CAT II Autofill for addresses must be disabled.
EDGE-00-000031 CAT II Personalization of ads, search, and news by sending browsing history to Microsoft must be disabled.
EDGE-00-000032 CAT II Site tracking of a user’s location must be disabled.
EDGE-00-000034 CAT III Edge development tools must be disabled.
EDGE-00-000036 CAT III Download restrictions must be configured.
EDGE-00-000041 CAT II Extensions installation must be blocklisted by default.
EDGE-00-000047 CAT II Site isolation for every site must be enabled.
EDGE-00-000048 CAT II Supported authentication schemes must be configured.
EDGE-00-000050 CAT II Microsoft Defender SmartScreen must be enabled.
EDGE-00-000051 CAT II Microsoft Defender SmartScreen must be configured to block potentially unwanted apps.
EDGE-00-000052 CAT III The download location prompt must be configured.
EDGE-00-000055 CAT II A website's ability to query for payment methods must be disabled.
EDGE-00-000056 CAT II Suggestions of similar web pages in the event of a navigation error must be disabled.
EDGE-00-000057 CAT II User feedback must be disabled.
EDGE-00-000058 CAT II The collections feature must be disabled.
EDGE-00-000059 CAT II The Share Experience feature must be disabled.
EDGE-00-000060 CAT II Guest mode must be disabled.
EDGE-00-000061 CAT II Relaunch notification must be required.
EDGE-00-000063 CAT II Use of the QUIC protocol must be disabled.
EDGE-00-000064 CAT III The list of domains media autoplay allows must be allowlisted if used.
EDGE-00-000065 CAT II Visual Search must be disabled.
EDGE-00-000066 CAT II Copilot must be disabled.
EDGE-00-000068 CAT II FriendlyURLs must be disabled.
EDGE-00-000069 CAT II Access to Microsoft 365 Copilot writing assistance must be disabled.
EDGE-00-000070 CAT II Spell checking provided by Microsoft Editor must be disabled.

Microsoft Windows 11 V2R11

WN11-00-000100 CAT I Internet Information System (IIS) or its subcomponents must not be installed on a workstation.
WN11-00-000105 CAT II Simple Network Management Protocol (SNMP) must not be installed on the system.
WN11-00-000110 CAT II Simple TCP/IP Services must not be installed on the system.
WN11-00-000115 CAT II The Telnet Client must not be installed on the system.
WN11-00-000120 CAT II The TFTP Client must not be installed on the system.
WN11-00-000125 CAT II Copilot must be disabled for Windows 11.
WN11-00-000126 CAT II Windows 11 systems must block consumer account user authentication.
WN11-00-000155 CAT II The Windows PowerShell 2.0 feature must be disabled on the system.
WN11-00-000160 CAT II The Server Message Block (SMB) v1 protocol must be disabled on the system.
WN11-00-000165 CAT II The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
WN11-00-000170 CAT II The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
WN11-00-000175 CAT II The Secondary Logon service must be disabled on Windows 11.
WN11-00-000210 CAT II Bluetooth must be turned off unless approved by the organization.
WN11-00-000395 CAT II Windows 11 must not have portproxy enabled or in use.
WN11-00-000400 CAT II All Wi-Fi Direct adapters must be disabled on the system.
WN11-CC-000005 CAT II Camera access from the lock screen must be disabled.
WN11-CC-000007 CAT II Windows 11 must cover or disable the built-in or attached camera when not in use.
WN11-CC-000010 CAT II The display of slide shows on the lock screen must be disabled.
WN11-CC-000038 CAT II WDigest Authentication must be disabled.
WN11-CC-000039 CAT II Run as different user must be removed from context menus.
WN11-CC-000044 CAT II Internet connection sharing must be disabled.
WN11-CC-000100 CAT II Downloading print driver packages over HTTP must be prevented.
WN11-CC-000105 CAT II Web publishing and online ordering wizards must be prevented from downloading a list of providers.
WN11-CC-000110 CAT II Printing over HTTP must be prevented.
WN11-CC-000120 CAT II The network selection user interface (UI) must not be displayed on the logon screen.
WN11-CC-000130 CAT II Local users on domain-joined computers must not be enumerated.
WN11-CC-000175 CAT III The Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
WN11-CC-000210 CAT II The Microsoft Defender SmartScreen for Explorer must be enabled.
WN11-CC-000252 CAT II Windows 11 must be configured to disable Windows Game Recording and Broadcasting.
WN11-CC-000300 CAT II Basic authentication for RSS feeds over HTTP must not be used.
WN11-CC-000305 CAT II Indexing of encrypted files must be turned off.
WN11-CC-000366 CAT II Windows 11 must be configured to prevent Windows apps from being activated by voice.
WN11-CC-000370 CAT II The convenience PIN for Windows 11 must be disabled.
WN11-CC-000390 CAT III Windows 11 must be configured to prevent users from receiving suggestions for third-party or additional applications.
WN11-UC-000015 CAT III Toast notifications to the lock screen must be turned off.

Microsoft Windows Server 2022 V2R11

WN22-00-000270 CAT II Windows Server 2022 must have the roles and features required by the system documented.
WN22-00-000320 CAT II Windows Server 2022 must not have the Fax Server role installed.
WN22-00-000330 CAT II Windows Server 2022 must not have the Microsoft FTP service installed unless required by the organization.
WN22-00-000340 CAT II Windows Server 2022 must not have the Peer Name Resolution Protocol installed.
WN22-00-000350 CAT II Windows Server 2022 must not have Simple TCP/IP Services installed.
WN22-00-000360 CAT II Windows Server 2022 must not have the Telnet Client installed.
WN22-00-000370 CAT II Windows Server 2022 must not have the TFTP Client installed.
WN22-00-000380 CAT II Windows Server 2022 must not the Server Message Block (SMB) v1 protocol installed.
WN22-00-000390 CAT II Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server.
WN22-00-000400 CAT II Windows Server 2022 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client.
WN22-00-000410 CAT II Windows Server 2022 must not have Windows PowerShell 2.0 installed.
WN22-CC-000010 CAT II Windows Server 2022 must prevent the display of slide shows on the lock screen.
WN22-CC-000020 CAT II Windows Server 2022 must have WDigest Authentication disabled.
WN22-CC-000150 CAT II Windows Server 2022 downloading print driver packages over HTTP must be turned off.
WN22-CC-000160 CAT II Windows Server 2022 printing over HTTP must be turned off.
WN22-CC-000170 CAT II Windows Server 2022 network selection user interface (UI) must not be displayed on the logon screen.
WN22-CC-000200 CAT III Windows Server 2022 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
WN22-CC-000300 CAT II Windows Server 2022 Microsoft Defender antivirus SmartScreen must be enabled.
WN22-CC-000400 CAT II Windows Server 2022 must disable Basic authentication for RSS feeds over HTTP.
WN22-CC-000410 CAT II Windows Server 2022 must prevent Indexing of encrypted files.
WN22-DC-000130 CAT II Windows Server 2022 domain controllers must run on a machine dedicated to that function.
WN22-MS-000030 CAT II Windows Server 2022 local users on domain-joined member servers must not be enumerated.

Microsoft Windows Server 2025 V1R4

WN25-00-000270 CAT II Windows Server 2025 must have the roles and features required by the system documented.
WN25-00-000320 CAT II Windows Server 2025 must not have the Fax Server role installed.
WN25-00-000330 CAT II Windows Server 2025 must not have the Microsoft FTP service installed unless required by the organization.
WN25-00-000332 CAT II Windows Server 2025 must not have Wi-Fi enabled unless required by the organization.
WN25-00-000333 CAT II Windows Server 2025 must not have Bluetooth enabled unless required by the organization.
WN25-00-000340 CAT II Windows Server 2025 must not have the Peer Name Resolution Protocol installed.
WN25-00-000350 CAT II Windows Server 2025 must not have Simple TCP/IP Services installed.
WN25-00-000360 CAT II Windows Server 2025 must not have the Telnet Client installed.
WN25-00-000370 CAT II Windows Server 2025 must not have the TFTP Client installed.
WN25-00-000380 CAT II Windows Server 2025 must not have the Server Message Block (SMB) v1 protocol installed.
WN25-00-000390 CAT II Windows Server 2025 must have the Server Message Block (SMB) v1 protocol disabled on the SMB server.
WN25-00-000400 CAT II Windows Server 2025 must have the Server Message Block (SMB) v1 protocol disabled on the SMB client.
WN25-00-000410 CAT II Windows Server 2025 must not have Windows PowerShell 2.0 installed.
WN25-CC-000010 CAT II Windows Server 2025 must prevent the display of slide shows on the lock screen.
WN25-CC-000150 CAT II Windows Server 2025 downloading print driver packages over HTTP must be turned off.
WN25-CC-000160 CAT II Windows Server 2025 printing over HTTP must be turned off.
WN25-CC-000170 CAT II Windows Server 2025 network selection user interface (UI) must not be displayed on the logon screen.
WN25-CC-000200 CAT III Windows Server 2025 Application Compatibility Program Inventory must be prevented from collecting data and sending the information to Microsoft.
WN25-CC-000300 CAT II Windows Server 2025 Microsoft Defender antivirus SmartScreen must be enabled.
WN25-CC-000400 CAT II Windows Server 2025 must disable Basic authentication for RSS feeds over HTTP.
WN25-CC-000410 CAT II Windows Server 2025 must prevent Indexing of encrypted files.
WN25-DC-000130 CAT II Windows Server 2025 domain controllers must run on a machine dedicated to that function.
WN25-MS-000030 CAT II Windows Server 2025 local users on domain-joined member servers must not be enumerated.

Mozilla Firefox V6R9

FFOX-00-000004 CAT II Firefox must be configured to not automatically check for updated versions of installed search plugins.
FFOX-00-000005 CAT II Firefox must be configured to not automatically update installed add-ons and plugins.
FFOX-00-000007 CAT II Firefox must be configured to disable form fill assistance.
FFOX-00-000008 CAT II Firefox must be configured to not use a password store with or without a master password.
FFOX-00-000009 CAT II Firefox must be configured to block pop-up windows.
FFOX-00-000010 CAT II Firefox must be configured to prevent JavaScript from moving or resizing windows.
FFOX-00-000011 CAT II Firefox must be configured to prevent JavaScript from raising or lowering windows.
FFOX-00-000013 CAT II Firefox must be configured to disable the installation of extensions.
FFOX-00-000014 CAT II Background submission of information to Mozilla must be disabled.
FFOX-00-000017 CAT II Firefox must be configured to not delete data upon shutdown.
FFOX-00-000019 CAT II Firefox private browsing must be disabled.
FFOX-00-000020 CAT II Firefox search suggestions must be disabled.
FFOX-00-000021 CAT III Firefox autoplay must be disabled.
FFOX-00-000022 CAT II Firefox network prediction must be disabled.
FFOX-00-000023 CAT II Firefox fingerprinting protection must be enabled.
FFOX-00-000024 CAT II Firefox cryptomining protection must be enabled.
FFOX-00-000025 CAT II Firefox Enhanced Tracking Protection must be enabled.
FFOX-00-000026 CAT II Firefox extension recommendations must be disabled.
FFOX-00-000027 CAT II Firefox deprecated ciphers must be disabled.
FFOX-00-000028 CAT II Firefox must not recommend extensions as the user is using the browser.
FFOX-00-000029 CAT II The Firefox New Tab page must not show Top Sites, Sponsored Top Sites, Pocket Recommendations, Sponsored Pocket Stories, Searches, Highlights, or Snippets.
FFOX-00-000033 CAT II Firefox must be configured so that DNS over HTTPS is disabled.
FFOX-00-000034 CAT II Firefox accounts must be disabled.
FFOX-00-000036 CAT II Firefox feedback reporting must be disabled.
FFOX-00-000037 CAT II Firefox encrypted media extensions must be disabled.
FFOX-00-000039 CAT II Firefox Studies must be disabled.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-200010 CAT II RHEL 10 must not have the "nfs-utils" package installed.
RHEL-10-200020 CAT I RHEL 10 must not have the "telnet-server" package installed.
RHEL-10-200030 CAT II RHEL 10 must not have the "gssproxy" package installed.
RHEL-10-200040 CAT II RHEL 10 must not have the tuned package installed.
RHEL-10-200060 CAT II RHEL 10 must not have the unbound package installed.
RHEL-10-200080 CAT II RHEL 10 must not have the "gdm" package installed.
RHEL-10-200090 CAT I RHEL 10 must not have a File Transfer Protocol (FTP) server package installed.
RHEL-10-200510 CAT II RHEL 10 must have the "nss-tools" package installed.
RHEL-10-200530 CAT II RHEL 10 must have the "firewalld" package installed.
RHEL-10-200531 CAT II RHEL 10 must have the "firewalld" service set to active.
RHEL-10-200542 CAT II RHEL 10 must disable the chrony daemon from acting as a server.
RHEL-10-200543 CAT II RHEL 10 must disable network management of the chrony daemon.
RHEL-10-200580 CAT II RHEL 10 must have the "policycoreutils-python-utils" package installed.
RHEL-10-200692 CAT II RHEL 10 must be configured to prevent unrestricted mail relaying.
RHEL-10-200700 CAT II RHEL 10 must have the "cronie" package installed.
RHEL-10-200722 CAT II RHEL 10 must have the "openssh-clients" package installed.
RHEL-10-200740 CAT II RHEL 10 must have the "gnutls-utils" package installed.
RHEL-10-400230 CAT II RHEL 10 must be configured to prohibit modification of permissions for cron configuration files and directories from the operating system defaults.
RHEL-10-400500 CAT II RHEL 10 must prohibit local initialization files from executing world-writable programs.
RHEL-10-700640 CAT I RHEL 10 must not allow users to override Secure Shell (SSH) environment variables.
RHEL-10-700840 CAT II RHEL 10 must disable the user list at login for graphical user interfaces.
RHEL-10-700860 CAT II RHEL 10 must disable Bluetooth.
RHEL-10-700940 CAT II RHEL 10 must not default to the graphical display manager unless approved.
RHEL-10-700980 CAT II RHEL 10 must disable the ability of systemd to spawn an interactive boot process.
RHEL-10-701020 CAT II RHEL 10 must enable mitigations against processor-based vulnerabilities.
RHEL-10-701090 CAT II RHEL 10 must disable the "kernel.core_pattern".
RHEL-10-701100 CAT II RHEL 10 must be configured to disable the Controller Area Network (CAN) kernel module.
RHEL-10-701110 CAT II RHEL 10 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
RHEL-10-701120 CAT II RHEL 10 must disable the Transparent Inter Process Communication (TIPC) kernel module.
RHEL-10-701150 CAT II RHEL 10 must disable core dump backtraces.
RHEL-10-701160 CAT II RHEL 10 must disable storing core dumps.
RHEL-10-701170 CAT II RHEL 10 must disable core dumps for all users.
RHEL-10-800000 CAT II RHEL 10 must control remote access methods.
RHEL-10-800010 CAT II RHEL 10 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-212050 CAT III RHEL 9 must enable mitigations against processor-based vulnerabilities.
RHEL-09-213045 CAT II RHEL 9 must be configured to disable the Asynchronous Transfer Mode kernel module.
RHEL-09-213050 CAT II RHEL 9 must be configured to disable the Controller Area Network kernel module.
RHEL-09-213055 CAT II RHEL 9 must be configured to disable the FireWire kernel module.
RHEL-09-213060 CAT II RHEL 9 must disable the Stream Control Transmission Protocol (SCTP) kernel module.
RHEL-09-213065 CAT II RHEL 9 must disable the Transparent Inter Process Communication (TIPC) kernel module.
RHEL-09-215015 CAT I RHEL 9 must not have a File Transfer Protocol (FTP) server package installed.
RHEL-09-215020 CAT II RHEL 9 must not have the sendmail package installed.
RHEL-09-215025 CAT II RHEL 9 must not have the nfs-utils package installed.
RHEL-09-215035 CAT II RHEL 9 must not install packages from the Extra Packages for Enterprise Linux (EPEL) repository.
RHEL-09-215040 CAT II RHEL 9 must not have the telnet-server package installed.
RHEL-09-215045 CAT II RHEL 9 must not have the gssproxy package installed.
RHEL-09-215050 CAT II RHEL 9 must not have the iprutils package installed.
RHEL-09-215055 CAT II RHEL 9 must not have the tuned package installed.
RHEL-09-231195 CAT III RHEL 9 must disable mounting of cramfs.
RHEL-09-251010 CAT II RHEL 9 must have the firewalld package installed.
RHEL-09-251015 CAT II The firewalld service on RHEL 9 must be active.
RHEL-09-251035 CAT II RHEL 9 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments.
RHEL-09-252025 CAT III RHEL 9 must disable the chrony daemon from acting as a server.
RHEL-09-252030 CAT III RHEL 9 must disable network management of the chrony daemon.
RHEL-09-291035 CAT II RHEL 9 Bluetooth must be disabled.

Samsung Android 16 COBO Y26M10

KNOX-16-006400 CAT II Samsung Android must be configured to disable developer modes.
KNOX-16-008300 CAT III Samsung Android must be configured to disable all Bluetooth profiles except for Headset Profile (HSP), Hands-Free Profile (HFP), Serial Port Profile (SPP), Advanced Audio Distribution Profile (A2DP), Audio/Video Remote Control Profile (AVRCP), and Phone Book Access Profile (PBAP).

CM-07 Least Functionality