NIST 800-171: 3.2 Awareness and Training 3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. Are essential system capabilities defined based on least functionality and are systems configured to meet these definitions? Is the information system configured to exclude any function not needed in the environment, and is one function per system, where practical?.