Administrative Rights and Privileges

Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems. (Source)

NIST SP 800-53 Rev 5: AC-6 Least Privilege
NIST resource that defines the requirements for the principle of least privilege
NIST SP 800-53 Rev 5: IA-4 Identifier Management
This special publication from NIST provides an overview of Identifier Management.
NIST SP 800-63 Digital Identity Guidelines
This NIST Special Publication covers identity proofing and authentication of users interacting with government IT systems over open networks.
NIST SP 800-63 Digital Identity Guidelines Frequently Asked Questions
This list covers NIST FAQs for Special Publication (SP) 800-63, Digital Identity Guidelines and provides additional clarification to stakeholders.

ISACA – Rethinking User Access Certifications
This article describes the importance of user access reviews, and offers suggestions for performing reviews manually or in an automated fashion.
Microsoft – Configure CMMC Level 2 Identification and Authentication (IA) controls
This article provides guidance for the Identification and Authorization (IA) domain. There's a table with links to content that provides step-by-step guidance to accomplish the practice.
Microsoft – Implementing Least-Privileged Administrative Models
Microsoft security best practices for employment of the least privilege principle.
National Center for Education Statistics – Protecting Your System: User Access Security
This link provides check points for user access security.

Crowdstrike – What is the Principle of Least Priviledge (POLP)?
Crowdstrike webpage providing security tips and resources for considerations on least privilege.
Microsoft – Security Identifiers
This document describes security identifiers and how they work in regards to accounts and groups in the Windows operating system.
ZenGRC – 6 Steps to Create an Effective User Access Review Program
As mentioned in the title, this article offers best practices to ensure an organization regularly validates a user’s set of permissions.

Gartner – Privileged Access Management Reviews and Rankings
This website from Gartner provides reviews and rating for PAM Tools.
Texas A&M – Sample Identification and Authentication Policy
This is an example of an identification and authentication policy for Texas A&M
University of Michigan – Access, Authorization, and Authentication Management
This sample policy from Michigan is an example of how an organization can provision and deprovision access to systems and applications.

CMMC Related Controls

CMMC Assessment Guides

CMMC Level 1 Self-Assessment Guide
This document provides self-assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 1.
CMMC Level 2 Assessment Guide
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2.
CMMC Level 3 Assessment Guide
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 3.
NIST SP 800-171A Assessing Security Requirements for Controlled Unclassified Information
The purpose of this publication is to provide procedures for assessing the CUI requirements in NIST Special Publication 800-171.

Administrative Rights and Privileges

Resources

Legal