This objective requires your organization to identify programs, services, or software that are not essential to the function or security of systems that handle Controlled Unclassified Information (CUI). These are candidates for removal or restriction to reduce your system’s attack surface.