AC.L2-3.1.7  

Reference: CMMC v2.13

Family: AC

Level Introduced: 2

Title: Privileged Functions

Practice:
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Further Discussion:
Non-privileged users should receive only those permissions required to perform their basic job functions. Privileged users are granted additional permissions because their jobs require them. Privileged functions typically involve the control, monitoring, or administration of the system and its security measures. When these special privileged functions are performed, the activity must be captured in an audit log, which can be used to identify abuse. Non-privileged employees must not be granted permission to perform any of the functions of a privileged user.

This requirement, AC.L2-3.1.7, manages non-privileged users by logging any attempts to execute privileged functions. AC.L2-3.1.7 leverages AU.L2-3.3.2, which ensures logging and traceability of user actions. AC.L2-3.1.7 also extends AC.L2-3.1.2, which defines a requirement to limit types of transactions and functions to those that authorized users are permitted to execute.

Example
Your organization handles CUI and has put security controls in place that prevent non-privileged users from performing privileged activities [a,b,c]. However, a standard user was accidentally given elevated system administrator privileges. The organization has implemented an endpoint detection and response solution that provides visibility into the use of privileged activities. The monitoring system logs a security misconfiguration because the use of administrative privileges was performed by a user who was not known to have that ability. This allows you to correct the error [d].

Potential Assessment Considerations
• Is it possible to identify who enabled privileges at any particular time [d]?
• Are the privileged system functions documented (e.g., functions that involve the control, monitoring or administration of the system, including security functions and log management) [a]?
• Do documented procedures describe the configuration of the system to ensure system roles do not grant non-privileged users the ability to execute privileged functions [c]?
• Do procedures describe the configuration of system settings to capture the execution of all privileged functions in audit logs [d]?

Source: CMMC v2.13