CMMC Requirement AC.L2-3.1.5 – Least Privilege: Employ the principle of least privilege, including for specific security functions and privileged accounts.
The following provides a sample mapping between the Cybersecurity Maturity Model Certification (CMMC) 2.0 Level 2 and AWS managed Config rules. Each Config rule applies to a specific AWS resource, and relates to one or more CMMC 2.0 Level 2 controls. A CMMC 2.0 Level 2 control can be related to multiple Config rules. This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2. This article provides an overview of the principle of least privilege and how it relates to Zero Trust. Crowdstrike webpage providing security tips and resources for considerations on least privilege. Offers actionable guidance on how to map Access Control CMMC Requirements to specific configurations in Microsoft Entra ID (Formerly Azure AD). Microsoft security best practices for employment of the least privilege principle. NIST resource that defines the requirements for the principle of least privilege This video discuss how to employ the principle of least privilege, including for specific security functions and privileged accounts. In this edition of the On Call Compliance Solutions Compliance Tip of the Week, they talk about employing the principle of least privilege including for specific security functions and privileged accounts.
Organizations employ the principle of least privilege for specific duties and authorized accesses for users and processes. The principle of least privilege is applied with the goal of authorized privileges no higher than necessary to accomplish required organizational missions or business functions. Organizations consider the creation of additional processes, roles, and system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational systems. Security functions include establishing system accounts, setting events to be logged, setting intrusion detection parameters, and configuring access authorizations (i.e., permissions, privileges).
Privileged accounts, including super user accounts, are typically described as system administrator for various types of commercial off-the-shelf operating systems. Restricting privileged accounts to specific personnel or roles prevents day-to-day users from having access to privileged information or functions. Organizations may differentiate in the application of this requirement between allowed privileges for local accounts and for domain accounts provided organizations retain the ability to control system configurations for key security parameters and as otherwise necessary to sufficiently mitigate risk.
Further Discussion
The principle of least privilege applies to all users and processes on all systems, but it is critical to systems containing or accessing CUI. Least privilege:
- restricts user access to only the machines and information needed to fulfill job responsibilities; and
- limits what system configuration settings users can change, only allowing individuals with a business need to change them.