AC.L2-3.1.6  

Reference: CMMC 2.0

Family: AC

Level Introduced: 2

Title: Non-Privileged Account Use

Practice:
Use non-privileged accounts or roles when accessing nonsecurity functions.

CMMC Clarification:
A user with a privileged account can perform more tasks and access more information than a person with a non-privileged account. This means that tasks performed when using the privileged account can have a greater impact on the system. You restrict administrator use of privileged accounts. Only those who perform a function that requires more access have a privileged account. This reduces the risk of unintentional harm to systems and data.

Example
As the IT administrator for your organization, you have two user accounts. One is a non- privileged account, which you use when performing non-privileged duties. These tasks include sending or receiving emails. The other is a privileged account, which you use only when performing administrative functions. Examples include troubleshooting a device or setting up new user accounts.

Source: CMMC v2.0