AC.L2-3.1.7
Privileged Functions
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.7 in the reference catalog with its NIST cross-references
Official requirement
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
Assessment objectives
a. privileged functions are defined;
b. non-privileged users are defined;
c. non-privileged users are prevented from executing privileged functions; and
d. the execution of privileged functions is captured in audit logs.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Prevent ordinary users from performing privileged functions and record privileged activity.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your organization handles CUI and ha s put security controls in place that prevent non- privileged users from performing privileged activities [a,b,c]. However, a standard user was accidentally given elevated system administrator privil eges. The organization has implemented an endpoint detection and response solution that provides visibility into the use of privileged activities. The monitoring system logs a security misconfiguration because the use of administrative privileges was performed by a user who was not known to have that ability. This allows you to correct the error [d].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Privacy and security policies, procedures addressing system use notification; documented approval of system use notification messages or banners; system audit logs and records; system design documentation; user acknowledgements of notification message or banner; system security plan; system use notification messages; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Restricting an administrator menu while leaving another path to the same privileged function.