A contractor plans to bid for a DoD contract and has installed new network file servers to separate their commercial and DoD work. When examining the server documentation, you realize that the server has some open ports. Upon further testing, you determine that the server has some default features that are not essential for file storage or transfer. The server has a default remote desktop functionality that allows users remote access to the server's desktop environment. Files are transferred by default using FTP, which is less secure than the Server Message Block (SMB) protocol. However, the contractor's operations do not require remote access capabilities. Although the roles of each system are defined in their configuration management policy, a user can install any application or service they need. After some interviews, you learn that this ensures every employee is comfortable using a system or software they are most conversant with, despite having defined services or software for carrying out specific functions.
Upon speaking with the OSC PoC when assessing CM.L2-3.4.6 - Least Functionality, they acknowledge deficiencies, place the practice in a POA&M, and request that you grant conditional certification.
How would you respond?