Disable Unneeded Accounts, Components, Services and Application Functionality

Plain language

Software and systems often ship with far more than your people actually use: spare login accounts, optional add-ons (components), background services, and built-in features inside everyday programs like web browsers, email clients and office software. This control says to switch off or delete anything you do not need. Each of these four areas matters: (1) **user accounts** that are no longer used, such as leftover logins from people who have left or test accounts; (2) **components**, which are optional add-on parts of an application; (3) **services**, which are background processes the software runs; and (4) **functionality of user applications**, meaning specific features inside the programs your staff use day to day. The idea is simple. The fewer accounts, parts and features that exist, the fewer ways there are for an attacker to get in or cause harm. This is often called reducing the "attack surface". A feature that is turned off cannot be exploited, so cleaning out the unused ones makes your systems both tidier and safer.