CM-7.1: Periodic Review

the system is reviewed frequency to identify unnecessary and/or non-secure functions, ports, protocols, software, and services:

Configuration management policy

procedures addressing least functionality in the system

configuration management plan

system design documentation

system configuration settings and associated documentation

common secure configuration checklists

documented reviews of functions, ports, protocols, and/or services

change control records

system audit records

system security plan

other relevant documents or records

Organizational personnel with responsibilities for reviewing functions, ports, protocols, and services on the system

organizational personnel with information security responsibilities

system/network administrators

system developers

Organizational processes for reviewing or disabling functions, ports, protocols, and services on the system

mechanisms implementing review and disabling of functions, ports, protocols, and/or services