SC.L2-3.13.3
Role Separation
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SC.L2-3.13.3 in the reference catalog with its NIST cross-references
Official requirement
Separate user functionality from system management functionality.
Assessment objectives
a. user functionality is identified;
b. system management functionality is identified; and
c. user functionality is separated from system management functionality.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Separate user functionality from system-management functionality.
Implementation example
Example from the source assessment guide (not a mandatory implementation): As a system administrator, you are responsible for managing a number of core systems. Policy prevents you from conducting any administration from the computer or system account you use for day -to-day work [a,b]. The servers you manage also are isolated from the main corporate network. To work with them you use a special unique account to connect to a “jump” server that has access to the systems you routinely administer.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing application partitioning; system design documentation; system configuration settings and associated documentation; system security plan; system audit logs and records; other relevant documents or records
Common mistakes
Exposing management interfaces through ordinary user access paths.