What this requirement asks
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
This is a CMMC Level 2 requirement in the Access Control family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (4)
- 3.1.7[a] — privileged functions are defined
- 3.1.7[b] — non-privileged users are defined
- 3.1.7[c] — non-privileged users are prevented from executing privileged functions
- 3.1.7[d] — the execution of privileged functions is captured in audit logs
What an assessor examines
Examine:
- Privacy and security policies, procedures addressing system use notification
- documented approval of system use notification messages or banners
- system audit logs and records
- system design documentation
- user acknowledgements of notification message or banner
- system security plan
- system use notification messages
- system configuration settings and associated documentation
- other relevant documents or records
Interview:
- Personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
- personnel with information security responsibilities
- system developers
Test:
- Mechanisms implementing least privilege functions for non-privileged users
- mechanisms auditing the execution of privileged functions
Evidence that defends it
Show policy settings; provide logs of denied attempts/admin events
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.