Requirement text: AC.3.018: Prevent non-privileged users from executing privileged functions and
capture the execution of such functions in audit logs.
DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Privileged functions include establishing system accounts, performing system integrity
checks, conducting patching operations, or administering cryptographic key management
activities. Non-privileged users are individuals that do not possess appropriate
authorizations. Circumventing intrusion detection and prevention mechanisms or malicious
code protection mechanisms are examples of privileged functions that require protection
from non-privileged users. Note that this requirement represents a condition to be achieved
by the definition of authorized privileges in 3.1.2 (AC.1.002).
Misuse of privileged functions, either intentionally or unintentionally by authorized users,
or by unauthorized external entities that have compromised system accounts, is a serious
and ongoing concern and can have significant adverse impacts on organizations. Logging the
use of privileged functions is one way to detect such misuse, and in doing so, help mitigate
the risk from insider threats and the advanced persistent threat.
CMMC CLARIFICATION
Non-privileged users should not be given permissions other than those required to do their
basic job functions. Privileged users are granted additional permissions. They are
employees given authorization to perform certain privileged functions involving the control,
monitoring, or administration of the system including security functions. When these special
privileged functions are performed, the activity should be captured in an audit log which can
be used to identify abuse. Non-privileged employees should not be granted permission to
perform any of the functions of a privileged user.
Example
As a system administrator for your organization you have security controls in place that
prevent non-privileged users from performing privileged activities. However, you
accidentally gave a standard user elevated system administrator privileges. The
organization has implemented an endpoint detection and response solution that provides
visibility into the use of privileged activities. This monitoring system logs the use of
administrative privileges by an unapproved user allowing you to correct the error.
References
• NIST SP 800-171 Rev 1 3.1.7
• NIST CSF v1.1 PR.AC-4
• CERT RMM v1.2 KIM:SG4.SP1
• NIST SP 800-53 Rev 4 AC-6(9), AC-6(10)