Attack Surface Reduction
LOW MODERATE HIGHRequirements NIST SOURCE
Require the developer of the system, system component, or system service to reduce attack surfaces to [thresholds].
Discussion (NIST Supplemental Guidance)
Attack surface reduction is closely aligned with threat and vulnerability analyses and system architecture and design. Attack surface reduction is a means of reducing risk to organizations by giving attackers less opportunity to exploit weaknesses or deficiencies (i.e., potential vulnerabilities) within systems, system components, and system services. Attack surface reduction includes implementing the concept of layered defenses, applying the principles of least privilege and least functionality, applying secure software development practices, deprecating unsafe functions, reducing entry points available to unauthorized users, reducing the amount of code that executes, and eliminating application programming interfaces (APIs) that are vulnerable to attacks.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for SA-15(5) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- thresholds to which attack surfaces are to be reduced are defined;
- the developer of the system, system component, or system service is required to reduce attack surfaces to <SA-15(05)_ODP thresholds>.
Examine
[SELECT FROM: System and services acquisition policy; procedures addressing development process, standards, and tools; procedures addressing attack surface reduction; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for the system or system service; system design documentation; network diagram; system configuration settings and associated documentation establishing/enforcing organization-defined thresholds for reducing attack surfaces; list of restricted ports, protocols, functions, and services; system security plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security responsibilities; organizational personnel responsible for attack surface reduction thresholds; system developer].
Test
[SELECT FROM: Organizational processes for defining attack surface reduction thresholds].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for SA-15(5). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- System and services acquisition policy
- system security plan
Configuration
- system design documentation
- system configuration settings and associated documentation establishing/enforcing organization-defined thresholds for reducing attack surfaces
Testing
- Organizational processes for defining attack surface reduction thresholds
Other Records
- procedures addressing development process, standards, and tools
- procedures addressing attack surface reduction
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system or system service
- network diagram
- list of restricted ports, protocols, functions, and services
- other relevant documents or records