AC.L2-3.1.2
Transaction & Function Control
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.2 in the reference catalog with its NIST cross-references
Official requirement
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
Assessment objectives
a. the types of transactions and functions that authorized users are permitted to execute are defined; and
b. system access is limited to the defined types of transactions and functions for authorized users.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Limit each authorized user's transactions and application functions to approved work.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your team manages DoD contracts for your company. Members of your team need to access the contract information to perform their work properly. Because some of that data contains CUI, you work wit h IT to set up your group ’s systems so that users can be assigned access based on their specific roles [a]. Each role limits whether an employee has read-access or create/read/delete/update -access [b]. Implementing this access control restricts access to CUI information unless specifically authorized.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing acces s enforcement; system security plan; system design documentation; list of approved authorizations including remote access authorizations; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Giving every authenticated user the same broad permissions.