Control statement
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
Discussion
Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.
From control text to operational evidence
Use Least Privilege as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to identity, authorization, least privilege, session boundaries, and access lifecycle governance.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- access approvals and entitlement records
- role and group configuration exports
- periodic access review results
- authentication and authorization logs
Common failure patterns
- standing privileges that outlive business need
- shared or orphaned accounts
- access rules implemented differently across systems
- approvals that cannot be traced to actual permissions
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
the principle of least privilege is employed, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
Examine
- Access control policy
- procedures addressing least privilege
- list of assigned access authorizations (user privileges)
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Mechanisms implementing least privilege functions
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Related defensive techniques
D3FEND maps this base control or one of its enhancements to the following defensive techniques. The ontology relation label is preserved and does not by itself prove implementation or effectiveness.
MITRE D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
Related NIST SP 800-171 requirements
These Rev. 3 requirements cite this base control or one of its enhancements as a source. The relationship does not by itself determine contractual applicability or complete implementation.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
AC-6(1) — Authorize Access to Security Functions
Authorize access for [Organization-defined: individuals and roles] to:
- (a)[Organization-defined: organization-defined security functions (deployed in hardware, software, and firmware)] ; and
- (b)[Organization-defined: security-relevant information].
Official discussion
Security functions include establishing system accounts, configuring access authorizations (i.e., permissions, privileges), configuring settings for events to be audited, and establishing intrusion detection parameters. Security-relevant information includes filtering rules for routers or firewalls, configuration parameters for security services, cryptographic key management information, and access control lists. Authorized personnel include security administrators, system administrators, system security officers, system programmers, and other privileged users.
Organization-defined parameters (6)
Assessment objectives and methods
- AC-06(01)(a)
- AC-06(01)(a)[01]access is authorized for [Organization-defined: individuals and roles] to [Organization-defined: security functions (deployed in hardware)];
- AC-06(01)(a)[02]access is authorized for [Organization-defined: individuals and roles] to [Organization-defined: security functions (deployed in software)];
- AC-06(01)(a)[03]access is authorized for [Organization-defined: individuals and roles] to [Organization-defined: security functions (deployed in firmware)];
- AC-06(01)(b)access is authorized for [Organization-defined: individuals and roles] to [Organization-defined: security-relevant information].
Examine
- Access control policy
- procedures addressing least privilege
- list of security functions (deployed in hardware, software, and firmware) and security-relevant information for which access must be explicitly authorized
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Mechanisms implementing least privilege functions
Related controls
AC-6(2) — Non-privileged Access for Nonsecurity Functions
Require that users of system accounts (or roles) with access to [Organization-defined: security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions.
Official discussion
Requiring the use of non-privileged accounts when accessing nonsecurity functions limits exposure when operating from within privileged accounts or roles. The inclusion of roles addresses situations where organizations implement access control policies, such as role-based access control, and where a change of role provides the same degree of assurance in the change of access authorizations for the user and the processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.
Organization-defined parameters (1)
Assessment objectives and methods
users of system accounts (or roles) with access to [Organization-defined: security functions or security-relevant information] are required to use non-privileged accounts or roles when accessing non-security functions.
Examine
- Access control policy
- procedures addressing least privilege
- list of system-generated security functions or security-relevant information assigned to system accounts or roles
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Mechanisms implementing least privilege functions
Related controls
AC-6(3) — Network Access to Privileged Commands
Authorize network access to [Organization-defined: privileged commands] only for [Organization-defined: compelling operational needs] and document the rationale for such access in the security plan for the system.
Official discussion
Network access is any access across a network connection in lieu of local access (i.e., user being physically present at the device).
Organization-defined parameters (2)
Assessment objectives and methods
- AC-06(03)[01]network access to [Organization-defined: privileged commands] is authorized only for [Organization-defined: compelling operational needs];
- AC-06(03)[02]the rationale for authorizing network access to privileged commands is documented in the security plan for the system.
Examine
- Access control policy
- procedures addressing least privilege
- system configuration settings and associated documentation
- system audit records
- list of operational needs for authorizing network access to privileged commands
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
Test
- Mechanisms implementing least privilege functions
Related controls
AC-6(4) — Separate Processing Domains
Provide separate processing domains to enable finer-grained allocation of user privileges.
Official discussion
Providing separate processing domains for finer-grained allocation of user privileges includes using virtualization techniques to permit additional user privileges within a virtual machine while restricting privileges to other virtual machines or to the underlying physical machine, implementing separate physical domains, and employing hardware or software domain separation mechanisms.
Assessment objectives and methods
separate processing domains are provided to enable finer-grain allocation of user privileges.
Examine
- Access control policy
- procedures addressing least privilege
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
- system developers
Test
- Mechanisms implementing least privilege functions
Related controls
AC-6(5) — Privileged Accounts
Restrict privileged accounts on the system to [Organization-defined: personnel or roles].
Official discussion
Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from accessing privileged information or privileged functions. Organizations may differentiate in the application of restricting privileged accounts between allowed privileges for local accounts and for domain accounts provided that they retain the ability to control system configurations for key parameters and as otherwise necessary to sufficiently mitigate risk.
Organization-defined parameters (1)
Assessment objectives and methods
privileged accounts on the system are restricted to [Organization-defined: personnel or roles].
Examine
- Access control policy
- procedures addressing least privilege
- list of system-generated privileged accounts
- list of system administration personnel
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Mechanisms implementing least privilege functions
Related controls
AC-6(6) — Privileged Access by Non-organizational Users
Prohibit privileged access to the system by non-organizational users.
Official discussion
An organizational user is an employee or an individual considered by the organization to have the equivalent status of an employee. Organizational users include contractors, guest researchers, or individuals detailed from other organizations. A non-organizational user is a user who is not an organizational user. Policies and procedures for granting equivalent status of employees to individuals include a need-to-know, citizenship, and the relationship to the organization.
Assessment objectives and methods
privileged access to the system by non-organizational users is prohibited.
Examine
- Access control policy
- procedures addressing least privilege
- list of system-generated privileged accounts
- list of non-organizational users
- system configuration settings and associated documentation
- audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Mechanisms prohibiting privileged access to the system
Related controls
AC-6(7) — Review of User Privileges
- (a)Review [Organization-defined: frequency] the privileges assigned to [Organization-defined: roles and classes] to validate the need for such privileges; and
- (b)Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.
Official discussion
The need for certain assigned user privileges may change over time to reflect changes in organizational mission and business functions, environments of operation, technologies, or threats. A periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions.
Organization-defined parameters (2)
Assessment objectives and methods
- AC-06(07)(a)privileges assigned to [Organization-defined: roles and classes] are reviewed [Organization-defined: frequency] to validate the need for such privileges;
- AC-06(07)(b)privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs.
Examine
- Access control policy
- procedures addressing least privilege
- list of system-generated roles or classes of users and assigned privileges
- system design documentation
- system configuration settings and associated documentation
- validation reviews of privileges assigned to roles or classes or users
- records of privilege removals or reassignments for roles or classes of users
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Mechanisms implementing review of user privileges
Related controls
AC-6(8) — Privilege Levels for Code Execution
Prevent the following software from executing at higher privilege levels than users executing the software: [Organization-defined: software].
Official discussion
In certain situations, software applications or programs need to execute with elevated privileges to perform required functions. However, depending on the software functionality and configuration, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications or programs, those users may indirectly be provided with greater privileges than assigned.
Organization-defined parameters (1)
Assessment objectives and methods
[Organization-defined: software] is prevented from executing at higher privilege levels than users executing the software.
Examine
- Access control policy
- procedures addressing least privilege
- list of software that should not execute at higher privilege levels than users executing software
- system design documentation
- system configuration settings and associated documentation
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
- system/network administrators
- system developers
Test
- Mechanisms implementing least privilege functions for software execution
AC-6(9) — Log Use of Privileged Functions
Log the execution of privileged functions.
Official discussion
The misuse of privileged functions, either intentionally or unintentionally by authorized users or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Logging and analyzing the use of privileged functions is one way to detect such misuse and, in doing so, help mitigate the risk from insider threats and the advanced persistent threat.
Assessment objectives and methods
the execution of privileged functions is logged.
Examine
- Access control policy
- procedures addressing least privilege
- system design documentation
- system configuration settings and associated documentation
- list of privileged functions to be audited
- list of audited events
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
- system/network administrators
- system developers
Test
- Mechanisms auditing the execution of least privilege functions
Related controls
AC-6(10) — Prohibit Non-privileged Users from Executing Privileged Functions
Prevent non-privileged users from executing privileged functions.
Official discussion
Privileged functions include disabling, circumventing, or altering implemented security or privacy controls, establishing system accounts, performing system integrity checks, and administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Privileged functions that require protection from non-privileged users include circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms. Preventing non-privileged users from executing privileged functions is enforced by [AC-3](#ac-3).
Assessment objectives and methods
non-privileged users are prevented from executing privileged functions.
Examine
- Access control policy
- procedures addressing least privilege
- system design documentation
- system configuration settings and associated documentation
- list of privileged functions and associated user account assignments
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
- organizational personnel with information security responsibilities
- system developers
Test
- Mechanisms implementing least privilege functions for non-privileged users
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.