In this Episode 7 of my Configuration Management (CM) series, I break down NIST SP 800-53 CM-7 (Least Functionality) in plain terms: configure your system to run only what it actually needs for the mission. The whole idea is simple—disable or remove nonessential functions, ports, protocols, services, and even unnecessary software so you can reduce the attack surface and cut off easy paths for attackers. I also talk about why CM-7 is selected across low, moderate, and high baselines (but not the privacy baseline), and why the “right” settings are always subjective to the system and the organization’s mission. I also connect CM-7 to firewalls and cloud security groups, because they work hand-in-hand. Least functionality is about turning off the unnecessary stuff on the host; firewall/security group rules enforce that same principle at the network layer. I use examples like disabling FTP and Telnet, then blocking ports 20/21 and 23 so even if something gets inadvertently enabled, you still have a backstop. Finally, I walk you through how I assess/test CM-7: review policies/procedures and the configuration management plan, interview key stakeholders, inspect firewall/ACL rule sets, run discovery scans for open ports and active services, and then validate everything against the SSP’s allowed ports/protocols/services. If it’s not in the SSP (and the list is current), it’s likely a finding—so keep your documentation aligned with reality.