# NIST SP 800-53 Rev. 5 CM-7(9) — Prohibiting The Use Of Unauthorized Hardware - Source: https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/cm-7-9-prohibiting-the-use-of-unauthorized-hardware - Section: [Compliance](https://support.icompaas.com/compliance) › [NIST SP 800-53 Rev. 5 Controls](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5) › CM — Configuration Management - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **NIST SP 800-53 Rev. 5**·Control `CM-7(9)`·high·Component: **Configuration Management** ## What this control requires > Identify authorized hardware, prohibit unauthorized connections, and periodically review/update the authorized list. Restrict non-essential hardware using endpoint security and network access controls to minimize the attack surface. This control supports the Inventory capability within the Configuration Management family. > > — NIST SP 800-53 Rev. 5, Control CM-7(9) ### In plain English Identify authorized hardware, prohibit unauthorized connections, and periodically review/update the authorized list. In practice, this means you can prove you access management-level controls on a defined cadence. ## Why it matters SP 800-53 is the catalogue every U.S. federal authorisation (FedRAMP, FISMA, CMMC) and most regulated industries point at. A missing control surfaces as a Plan of Action & Milestones (POA&M) item that an Authorizing Official must approve before the Authority To Operate is granted or renewed. This control is rated **high**. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation. ## What an auditor looks for A 3PAO (FedRAMP) or Independent Assessor (NIST RMF) tests against NIST SP 800-53A assessment procedures. For each control they expect a documented implementation that addresses every assessment objective (Examine, Interview, Test) and an implementation summary in the System Security Plan. Within **Configuration Management**, the assessor will trace your implementation back to the catalogue reference (Control CM-7(9)) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Endpoint Protection **MDM.** Make MDM enrollment a hard gate for device access (Intune compliance + Conditional Access, or Jamf + Okta device trust). Unmanaged devices simply don't get a session token. **EDR.** Deploy CrowdStrike / SentinelOne / Defender for Endpoint to every server and laptop; alert on any host that stops sending telemetry for >24h. #### Network Security **AWS.** VPC Flow Logs to S3, default-deny security groups, AWS Network Firewall for north-south, and Transit Gateway for hub-and-spoke segmentation. **Azure.** NSGs with deny-by-default, Azure Firewall Premium with TLS inspection, Private Endpoints for PaaS, and Microsoft Defender for Cloud's secure score for drift. **GCP.** VPC Service Controls perimeters around sensitive APIs, Cloud NGFW Enterprise for L7 inspection, Private Service Connect for managed services. ### Operational checklist - **Access.** Document the trigger, the owner and the cadence. - **Restrict.** Document the trigger, the owner and the cadence. - **Security.** Document the trigger, the owner and the cadence. - **Configuration.** Document the trigger, the owner and the cadence. - **Network.** Document the trigger, the owner and the cadence. - **Scope:** management, controls, protection, configuration, hardware, review, access controls, capability. ## Evidence to collect - **User Device Scan.** MDM compliance state per user device (Intune / Jamf / Workspace ONE). Endpoint compliance telemetry (Intune, Jamf) proves managed coverage. Focus: Prohibiting The Use Of Unauthorized Hardware. ## Common pitfalls - Pilot MDM rollouts that quietly exclude executives or engineers; carving out the highest-risk users is the most common audit failure. - Default-allow egress rules; East-West traffic with no segmentation; jump hosts on the public internet with password auth. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**NIST SP 800-171 Rev. 3 3.4.12** — System and Component Configuration for High-Risk Areas](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-12-system-and-component-configuration-for-high-risk-areas) ## Related controls in NIST SP 800-53 Rev. 5 - [**Control CM-8(1)** — Updates During Installation And Removal](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/cm-8-1-updates-during-installation-and-removal) - [**Control CM-8(2)** — Automated Maintenance](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/cm-8-2-automated-maintenance) - [**Control CM-8(9)** — Assignment Of Components To Systems](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/cm-8-9-assignment-of-components-to-systems) - [**Control AT-3(2)** — Physical Security Controls](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/at-3-2-physical-security-controls) - [**Control AC-19** — Access Control For Mobile Devices](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/ac-19-access-control-for-mobile-devices) - [**Control PE-3** — Physical Access Control](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/pe-3-physical-access-control) ## References - [NIST Computer Security Resource Center — NIST SP 800-53 Rev. 5](https://csrc.nist.gov/Projects/risk-management/sp800-53-controls) - Catalogue identifier: `Control CM-7(9)` Topics: endpoint securityendpoint protectionnetwork securitypatch management ## Related compliance guidance - [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): Start with the full NIST SP 800-53 implementation guide — scope, roadmap, evidence and how the assessment runs. - [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If your obligation is protecting CUI in your own systems for a federal or defence contract, this derived subset — not the full catalogue — is the requirement. - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most commercial SaaS already hold a SOC 2 Type 2, and FedRAMP 20x Class A is designed for providers that have one.