AC.L2-3.1.6
Non-Privileged Account Use
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.6 in the reference catalog with its NIST cross-references
Official requirement
Use non-privileged accounts or roles when accessing nonsecurity functions.
Assessment objectives
a. nonsecurity functions are identified; and
b. users are required to use non-privileged accounts or roles when accessing nonsecurity functions.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Use ordinary accounts for ordinary work and reserve privileged accounts for privileged tasks.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are logged in using your privileged account and you need to look up how to reset a non- functioning application which processes CUI . You should log on to another computer with your non-privileged account before you connect to the web and start searching for the reset information [b]. That way, if your account is compromised during the search, it will be your regular user account rather than an account with elevated privileges.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing least privilege; system security plan; list of system -generated security functions assigned to system accounts or roles; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Reading email and browsing the web through a daily administrator account.