• Requirement

    Require the developer of the system, system component, or system service to reduce attack surfaces to [Assignment: organization-defined thresholds].

  • Discussion

    Attack surface reduction is closely aligned with threat and vulnerability analyses and system architecture and design. Attack surface reduction is a means of reducing risk to organizations by giving attackers less opportunity to exploit weaknesses or deficiencies (i.e., potential vulnerabilities) within systems, system components, and system services. Attack surface reduction includes implementing the concept of layered defenses, applying the principles of least privilege and least functionality, applying secure software development practices, deprecating unsafe functions, reducing entry points available to unauthorized users, reducing the amount of code that executes, and eliminating application programming interfaces (APIs) that are vulnerable to attacks.

More Info

  • Title

    Development Process, Standards, and Tools | Attack Surface Reduction
  • Family

    System and Services Acquisition
  • Related NIST 800-53 ID


CMMC Training

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!