The organization shall configure the business critical systems to provide only =Levels!$C14 capabilities.
The organization shall disable defined functions, ports, protocols, and services within its critical systems that it deems unnecessary.
The organization shall implement technical safeguards to enforce a deny-all, permit-by-exception policy to only allow the execution of authorized software programs.