3.5.6

5.4.3.1 (b) The organization shall implement secure configurations for all their devices unless it is impossible to do so on a specific device:
a) by turning off unnecessary features i.e., block unused ports, disable unused services, remove unused or obsolete software; and
b) by enabling all relevant security features.