3.4.7Close unnecessary ports and services in Rev. 3
Withdrawn and incorporated elsewhere: 03.04.06 Least Functionality, 03.04.08 Authorized Software – Allow by Exception.
Status as of 2026-09-08
Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.
Side by side
Rev. 2 · in force 3.4.7 Nonessential Functionality
Assessment objectives · 800-171A
- [a] essential programs are defined
- [b] the use of nonessential programs is defined
- [c] the use of nonessential programs is restricted, disabled, or prevented as defined
- [d] essential functions are defined
- [e] the use of nonessential functions is defined
- [f] the use of nonessential functions is restricted, disabled, or prevented as defined
- [g] essential ports are defined
- [h] the use of nonessential ports is defined
- [i] the use of nonessential ports is restricted, disabled, or prevented as defined
- [j] essential protocols are defined
- [k] the use of nonessential protocols is defined
- [l] the use of nonessential protocols is restricted, disabled, or prevented as defined
- [m] essential services are defined
- [n] the use of nonessential services is defined
- [o] the use of nonessential services is restricted, disabled, or prevented as defined
Rev. 3 · not adopted 03.04.06 Least Functionality
a. Configure the system to provide only mission-essential capabilities.
b. Prohibit or restrict use of the following functions, ports, protocols, connections, and services: [Assignment: organization-defined functions, ports, protocols, connections, and services].
c. Review the system [Assignment: organization-defined frequency] to identify unnecessary or nonsecure functions, ports, protocols, connections, and services.
d. Disable or remove functions, ports, protocols, connections, and services that are unnecessary or nonsecure.
Determination statements · 800-171A Rev. 3
- 03.04.06.a the system is configured to provide only mission-essential capabilities.
- 03.04.06.b[01] the use of the following functions is prohibited or restricted: <A.03.04.06.ODP[01]: functions>.
- 03.04.06.b[02] the use of the following ports is prohibited or restricted: <A.03.04.06.ODP[02]: ports>.
- 03.04.06.b[03] the use of the following protocols is prohibited or restricted: <A.03.04.06.ODP[03]: protocols>.
- 03.04.06.b[04] the use of the following connections is prohibited or restricted: <A.03.04.06.ODP[04]: connections>.
- 03.04.06.b[05] the use of the following services is prohibited or restricted: <A.03.04.06.ODP[05]: services>.
- 03.04.06.c the system is reviewed <A.03.04.06.ODP[06]: frequency> to identify unnecessary or nonsecure functions, ports, protocols, connections, and services.
- 03.04.06.d unnecessary or nonsecure functions, ports, protocols, connections, and services are disabled or removed.
Organization-defined parameters
- A.03.04.06.ODP[01] functions to be prohibited or restricted are defined.
- A.03.04.06.ODP[02] ports to be prohibited or restricted are defined.
- A.03.04.06.ODP[03] protocols to be prohibited or restricted are defined.
- A.03.04.06.ODP[04] connections to be prohibited or restricted are defined.
- A.03.04.06.ODP[05] services to be prohibited or restricted are defined.
- A.03.04.06.ODP[06] the frequency at which to review the system to identify unnecessary or nonsecure functions, ports, protocols, connections, or services is defined.
Rev. 3 · not adopted 03.04.08 Authorized Software – Allow by Exception
a. Identify software programs authorized to execute on the system.
b. Implement a deny-all, allow-by-exception policy for the execution of authorized software programs on the system.
c. Review and update the list of authorized software programs [Assignment: organization-defined frequency].
Determination statements · 800-171A Rev. 3
- 03.04.08.a software programs authorized to execute on the system are identified.
- 03.04.08.b a deny-all, allow-by-exception policy for the execution of authorized software programs on the system is implemented.
- 03.04.08.c the list of authorized software programs is reviewed and updated <A.03.04.08.ODP[01]: frequency>.
Organization-defined parameters
- A.03.04.08.ODP[01] the frequency at which to review and update the list of authorized software programs is defined.
Left: NIST SP 800-171 Rev. 2 and 800-171A, verbatim. Right: NIST SP 800-171 Rev. 3 and 800-171A Rev. 3, verbatim, with organization-defined blanks highlighted.
Word by word
The Rev. 2 requirement compared with each Rev. 3 requirement it feeds into. A mechanical comparison of the two verbatim texts, not an interpretation.
removed in Rev. 3 added in Rev. 3
Rev. 2 3.4.7 → Rev. 3 03.04.06 Least Functionality
8 words kept, 6 removed, 52 added. Rev. 3 statement labels omitted for the comparison.
Rev. 2 3.4.7 → Rev. 3 03.04.08 Authorized Software – Allow by Exception
4 words kept, 10 removed, 32 added. Rev. 3 statement labels omitted for the comparison.
What NIST says changed
Rev. 3 withdraws this requirement as a separate item and folds it into other requirements. NIST's note: Incorporated into 03.04.06 and 03.04.08.
NIST's Rev. 3 discussion for 03.04.06
Systems can provide a variety of functions and services. Some functions and services that are routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. It may be convenient to provide multiple services from single system components. However, doing so increases risk over limiting the services provided by any one component. Where feasible, organizations limit functionality to a single function per component. Organizations review the functions and services provided by the system or system components to determine which functions and services are candidates for elimination. Organizations disable unused or unnecessary physical and logical ports and protocols to prevent the unauthorized connection of devices, the transfer of information, and tunneling. Organizations can employ network scanning tools, intrusion detection and prevention systems, and endpoint protection systems (e.g., firewalls and host-based intrusion detection systems) to identify and prevent the use of prohibited functions, ports, protocols, system connections, and services. Bluetooth, File Transfer Protocol (FTP), and peer-to-peer networking are examples of the types of protocols that organizations consider eliminating, restricting, or disabling.
NIST's Rev. 3 discussion for 03.04.08
If provided with the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved “app stores.” The policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods. Authorized software programs can be limited to specific versions or come from specific sources. To facilitate a comprehensive authorized software process and increase the strength of protection against attacks that bypass application-level authorized software, software programs may be decomposed into and monitored at different levels of detail. These levels include applications, application programming interfaces, application modules, scripts, system processes, system services, kernel functions, registries, drivers, and dynamic link libraries.
What this means for you now
Nothing changes in what you are assessed against until a class deviation or a published rule adopts Rev. 3. Keep meeting 3.4.7 as written in Rev. 2.
Bedrock CMMC shows this same comparison against your own package, with your current status on the Rev. 2 side, so the day adoption lands the migration is a review, not a rewrite.
Where this page's facts come from
- Rev. 2 text and objectives
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2; bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
- Mapping and change class
- bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
- Rev. 3 03.04.06
- bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]
- Rev. 3 03.04.08
- bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]