Skip to main content
govconCyber — Federal Cybersecurity Law Reference
Back to results
NIST 800-171 R-3.4.7

Restrict Nonessential Programs and Services

Official citation: 3.4.7

Class: core · Severity: high

Statement of the obligation — verify against source

3.4.7

What it means

Restrict, disable, or prevent nonessential programs, functions, ports, protocols, and services. Techniques include limiting who can approve program execution, blocking auto-run, allow/deny-listing programs, and disabling risky protocols such as Bluetooth, FTP, and peer-to-peer networking — based on a security-driven determination of what you actually need.

Educational reference only — not legal advice. Consult a qualified assessor or attorney for binding compliance determinations.