CM-7(2) - Least Functionality | Prevent Program Execution
Prevent program execution in accordance with [Selection (one or more):
[Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions]
; rules authorizing the terms and conditions of software program usage].
Mode-aware functionality can reduce risk while preserving operability. Consider ensuring nonessential capabilities are available only in defined modes (e.g., maintenance), that transitions in/out of those modes clean up elevated privileges, and that safe/contingency modes narrow the active surface by default. Telemetry that explicitly reports which capabilities are enabled/disabled after resets or SEUs helps validate least-functionality assumptions during short passes.
Exploit ground system and use to maliciously to interact with the spacecraft
Sample Requirements
SPARTA ID
Requirement
Rationale/Additional Guidance/Notes
SPR-179
The [spacecraft] shall be configured to restrict software execution to only the software/processes that are explicitly authorized and necessary for operational purposes.{SV-SP-3,SV-SP-1}{CM-7(2)}
Allowlisting executable processes prevents unauthorized or malicious code execution. This reduces attack surface and blocks persistence mechanisms. Spacecraft compute resources are constrained, making minimal execution environments safer and more predictable. Only mission-essential binaries should be permitted.
SPR-180
The [spacecraft] shall enforce least functionality principles to prevent the execution of unauthorized software.{SV-SP-3,SV-SP-1}{CM-7(2)}
Limiting enabled services and functions reduces exploitable entry points. Unused capabilities create unnecessary risk without mission benefit. Least functionality supports deterministic system behavior. Reduced complexity improves resilience and monitoring accuracy.
SPR-530
The [spacecraft] shall enable selected maintenance capabilities only within time‑bounded and mode‑bounded windows, audit enable/disable events, auto‑revert on timeout/reset, and expose enabled/disabled capability state in telemetry.{SV-AC-8,SV-AC-4}{CM-7,CM-7(2),SA-8,SA-8(14),AC-3}