AC-6 — Least Privilege | Defense Map

NIST SP 800-53 control context

AC-6 — Least Privilege

Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.

Read the official statement, discussion, parameters, enhancements, and assessment methods →

Outcome layer

NIST CSF 2.0 informative references

These CSF Subcategories list this base control or one of its enhancements in the imported NIST informative reference.

PR.AA-05Manage Permissions and AuthorizationsAC-6

CUI protection layer

NIST SP 800-171 and SP 800-172

SP 800-171 requirements sourcing this control

03.01.05Least PrivilegeAC-6 03.01.06Least Privilege – Privileged AccountsAC-6(2)03.01.07Least Privilege – Privileged FunctionsAC-6(10)

SP 800-172 enhanced requirements sourcing this control

No relationship is present in the currently imported source datasets.

Defensive engineering layer

MITRE D3FEND techniques

D3-HBPIHardware-based Process Isolationnarrower · AC-6(4)D3-LAMLocal Account Monitoringbroader · AC-6(9)D3-LFPLocal File Permissionsbroader · AC-6 D3-LFPLocal File Permissionsnarrower · AC-6(10)D3-LFPLocal File Permissionsnarrower · AC-6(5)D3-LFPLocal File Permissionsnarrower · AC-6(6)D3-SCPSystem Configuration Permissionsexactly · AC-6(1)D3-SCPSystem Configuration Permissionsnarrower · AC-6(10)D3-SCPSystem Configuration Permissionsexactly · AC-6(3)D3-SCPSystem Configuration Permissionsnarrower · AC-6(5)D3-SCPSystem Configuration Permissionsnarrower · AC-6(6)D3-UAPUser Account Permissionsbroader · AC-6

Show 1 additional relationships

D3-UBAUser Behavior Analysisbroader · AC-6(9)

Adversary layer

MITRE ATT&CK relationships

Curated mitigation mappings

M1015Active Directory ConfigurationCurated through D3-UAP M1018User Account ManagementCurated through D3-LFP M1018User Account ManagementCurated through D3-SCP M1022Restrict File and Directory PermissionsCurated through D3-LFP M1024Restrict Registry PermissionCurated through D3-SCP M1026Privileged Account ManagementCurated through D3-LAM M1043Credential Access ProtectionCurated through D3-HBPI M1047AuditCurated through D3-LAM M1048Application Isolation and SandboxingCurated through D3-HBPI

Inferred behavior relationships

Experimental: These relationships are inferred through D3FEND and must be validated against architecture, telemetry, and threat context.

T1001Data ObfuscationInferred through D3-UBA T1003.001LSASS MemoryInferred through D3-HBPI T1003.002Security Account ManagerInferred through D3-HBPI T1003.003NTDSInferred through D3-UBA T1003.004LSA SecretsInferred through D3-HBPI T1003.005Cached Domain CredentialsInferred through D3-UBA T1003.006DCSyncInferred through D3-UBA T1003.007Proc FilesystemInferred through D3-LFP T1003.008/etc/passwd and /etc/shadowInferred through D3-LFP T1003.008/etc/passwd and /etc/shadowInferred through D3-UBA T1005Data from Local SystemInferred through D3-LFP T1007System Service DiscoveryInferred through D3-HBPI

Show 253 additional relationships

T1053.004LaunchdInferred through D3-LFP

T1053.005Scheduled TaskInferred through D3-HBPI T1055.001Dynamic-link Library InjectionInferred through D3-LFP T1055.002Portable Executable InjectionInferred through D3-LFP T1055.003Thread Execution HijackingInferred through D3-LFP T1055.004Asynchronous Procedure CallInferred through D3-HBPI T1055.009Proc MemoryInferred through D3-LFP T1055.013Process DoppelgängingInferred through D3-HBPI T1055.014VDSO HijackingInferred through D3-LFP T1057Process DiscoveryInferred through D3-HBPI T1059Command and Scripting InterpreterInferred through D3-LFP

T1070.002Clear Linux or Mac System LogsInferred through D3-LFP

T1142KeychainInferred through D3-UBA

T1547.011Plist ModificationInferred through D3-LFP

T1562.001Disable or Modify ToolsInferred through D3-HBPI

T1562.003Impair Command History LoggingInferred through D3-LFP

T1574.002DLL Side-LoadingInferred through D3-LFP

Relationship boundaries

Use the map without overclaiming.

A CSF informative reference is not an equivalence statement. A source-control relationship is not proof of implementation. A D3FEND semantic relationship is not a product claim. An inferred ATT&CK link is a hypothesis for engineering analysis.

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST or MITRE. Informative references and cross-framework relationships support navigation and analysis; they do not establish compliance, applicability, equivalence, control inheritance, or guaranteed mitigation effectiveness.