AC.L2-3.1.5
Least Privilege
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.5 in the reference catalog with its NIST cross-references
Official requirement
Employ the principle of least privilege, including for specific security functions and privileged accounts.
Assessment objectives
a. privileged accounts are identified;
b. access to privileged accounts is authorized in accordance with the principle of least privilege;
c. se curity functions are identified; and
d. access to security functions is authorized in accordance with the principle of least privilege.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Grant only the privileges needed for each task, including security and administrator functions.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You create accounts for an organization that processes CUI. By default, everyone is assigned a basic user role , which prevents a user from modifying system configurations. Privileged access is only assigned to users and processes that require it to carry out job functions, such as IT staff, and is very selectively granted [b,d].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing account management; system security plan; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; list of conditions for group and role membership; notifications or records of recently transferred, separated, or terminated employees; list of recently disabled system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews; system monitoring/audit records; procedures addressing least privilege; list of security functions (deployed in hardware, software, and firmware) and security-relevant information for which access is to be explicitly authorized; list of system -generated privileged accounts; list of system administration personnel; other relevant documents or records
Common mistakes
Keeping broad administrator access simply because it is convenient.