Device Class 1: Least Privilege
| Control ID: AC-6 Least Privilege | Family: Access Control | Source: NIST 800-53r4 |
| Control: The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. | ||
| Supplemental Guidance: N/A Related Controls: N/A |
||
| Control Enhancements:
(9) Least Privilege | Auditing Use Of Privileged Functions The information system audits the execution of privileged functions. Supplemental Guidance: Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse, and in doing so, help mitigate the risk from insider threats and the advanced persistent threat (APT). Related Controls: AU-2 (10) Least Privilege | Prohibit Non-privileged Users From Executing Privileged Functions The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. Supplemental Guidance: Privileged functions include, for example, establishing information system accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Related Controls: N/A |
||
| References: N/A | ||
| Mechanisms:
No specific mechanisms given: see AC-3. |
||
| Protocol Implementation Conformance Statements: N/A | ||