AC-6: Least Privilege
Control Family:
Threats Addressed:
Next Version:
- NIST Special Publication 800-53 Revision 5:
- AC-6: Least Privilege
Control Statement
The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
Supplemental Guidance
Organizations employ least privilege for specific duties and information systems. The principle of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions/business functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational information systems.
Control Enhancements
AC-6(1): Authorize Access To Security Functions
Baseline(s):
- Moderate
- High
The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].
AC-6(2): Non-Privileged Access For Nonsecurity Functions
Baseline(s):
- Moderate
- High
The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use non-privileged accounts or roles, when accessing nonsecurity functions.
AC-6(3): Network Access To Privileged Commands
Baseline(s):
- High
The organization authorizes network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and documents the rationale for such access in the security plan for the information system.
AC-6(4): Separate Processing Domains
Baseline(s):
The information system provides separate processing domains to enable finer-grained allocation of user privileges.
AC-6(5): Privileged Accounts
Baseline(s):
- Moderate
- High
The organization restricts privileged accounts on the information system to [Assignment: organization-defined personnel or roles].
AC-6(6): Privileged Access By Non-Organizational Users
Baseline(s):
The organization prohibits privileged access to the information system by non-organizational users.
AC-6(7): Review Of User Privileges
Baseline(s):
The organization: Reviews [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and Reassigns or removes privileges, if necessary, to correctly reflect organizational mission/business needs.
AC-6(8): Privilege Levels For Code Execution
Baseline(s):
The information system prevents [Assignment: organization-defined software] from executing at higher privilege levels than users executing the software.
AC-6(9): Auditing Use Of Privileged Functions
Baseline(s):
- Moderate
- High
The information system audits the execution of privileged functions.
AC-6(10): Prohibit Non-Privileged Users From Executing Privileged Functions
Baseline(s):
- Moderate
- High
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.