diff --git a/src/soc/intel/common/block/cse/Kconfig b/src/soc/intel/common/block/cse/Kconfig
index d1548a1fcb..ce998e4b56 100644
--- a/src/soc/intel/common/block/cse/Kconfig
+++ b/src/soc/intel/common/block/cse/Kconfig
@@ -463,3 +463,11 @@ config CSE_RESET_CLEAR_EC_AP_IDLE_FLAG
 	  Select this if the variant is a Chromebox/base. This allows AP to direct EC
 	  to clear AP_IDLE flag before triggering reset to make sure AP can boot up
 	  after reset.
+
+config CSE_DEFAULT_CFR_OPTION_STATE_DISABLED
+	bool
+	default n
+	help
+	  Mainboards can select this if using the CFR option backend to configure
+	  the ME operational state and want the default state to be disabled.
+	  If not selected, the default state will be enabled.
diff --git a/src/soc/intel/common/block/include/intelblocks/cfr.h b/src/soc/intel/common/block/include/intelblocks/cfr.h
index c240b769f3..fe9af039a6 100644
--- a/src/soc/intel/common/block/include/intelblocks/cfr.h
+++ b/src/soc/intel/common/block/include/intelblocks/cfr.h
@@ -16,7 +16,7 @@ static const struct sm_object me_state = SM_DECLARE_ENUM({
 	.opt_name	= "me_state",
 	.ui_name	= "Intel Management Engine",
 	.ui_helptext	= "Enable or disable the Intel Management Engine",
-	.default_value	= 0,
+	.default_value	= CONFIG(CSE_DEFAULT_CFR_OPTION_STATE_DISABLED),
 	.values		= (const struct sm_enum_value[]) {
 				{ "Disabled",		1		},
 				{ "Enabled",		0		},