What this requirement asks
Employ the principle of least privilege, including for specific security functions and privileged accounts.
This is a CMMC Level 2 requirement in the Access Control family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (4)
- 3.1.5[a] — privileged accounts are identified
- 3.1.5[b] — access to privileged accounts is authorized in accordance with the principle of least privilege
- 3.1.5[c] — security functions are identified
- 3.1.5[d] — access to security functions is authorized in accordance with the principle of least privilege
What an assessor examines
Examine:
- Access control policy
- procedures addressing account management
- system security plan
- system design documentation
- system configuration settings and associated documentation
- list of active system accounts and the name of the individual associated with each account
- list of conditions for group and role membership
- notifications or records of recently transferred, separated, or terminated employees
- list of recently disabled system accounts along with the name of the individual associated with each account
- access authorization records
- account management compliance reviews
- system monitoring/audit records
- procedures addressing least privilege
- list of security functions (deployed in hardware, software, and firmware) and security-relevant information for which access is to be explicitly authorized
- list of system-generated privileged accounts
- list of system administration personnel
- other relevant documents or records
Interview:
- Personnel with account management responsibilities
- system or network administrators
- personnel with information security responsibilities
- personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
Test:
- Organizational processes for managing system accounts
- mechanisms for implementing account management
- mechanisms implementing least privilege functions
- mechanisms prohibiting privileged access to the system
Evidence that defends it
Export admin group membership; review logs of privilege use
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.