Req 2.2.5 emphasizes removing unnecessary functionality. What should be verified about system components?

• A. Keep all scripts and drivers as a precaution
• B. Ensure only necessary functionality exists; remove unnecessary scripts, drivers, features
• C. Enable all subsystems
• D. Keep extra web servers running

Answer: (B)

Minimizing the system’s exposure by running only what’s needed. Requirement 2.2.5 is about removing unnecessary functionality from information systems in scope, so the verification focuses on ensuring that each component includes only the features, scripts, drivers, and subsystems that are essential for its role. When you verify, you look for evidence that anything optional has been removed or disabled—unneeded scripts and drivers are gone, unnecessary features are disabled or uninstalled, and there aren’t extra subsystems or services enabled that aren’t required for business purposes. This tightens the attack surface, reduces potential vulnerabilities, and simplifies configuration management and patching.

Keeping extra scripts, drivers, subsystems, or web servers around increases risk by adding potential entry points and outdated code to maintain. Enabling everything unnecessarily expands complexity without any security benefit.