CM-7(9) Prohibiting The Use of Unauthorized Hardware
Control enhancement of CM-7 Least Functionality
Control
Identify [Assignment: hardware components];
Prohibit the use or connection of unauthorized hardware components;
Review and update the list of authorized hardware components [Assignment: frequency].
Discussion
Hardware components provide the foundation for organizational systems and the platform for the execution of authorized software programs. Managing the inventory of hardware components and controlling which hardware components are permitted to be installed or connected to organizational systems is essential in order to provide adequate security.
Need CM-7(9) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.