Least Privilege (03.01.05)_least-privilege

Least Privilege (03.01.05) Least Privilege

High-Level Description

Family: Access Control Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI

Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks. Authorize access to [organization-defined] and [organization-defined]. Review the privileges assigned to roles or classes of users [organization-defined] to validate the need for such privileges. Reassign or remove privileges, as necessary.

What to Check

• Verify Least Privilege (03.01.05) Least Privilege is implemented for CUI systems
• Review SSP documentation for Least Privilege (03.01.05)
• Validate CMMC Level 2 assessment objective for Least Privilege (03.01.05)
• Confirm POA&M addresses any gaps for Least Privilege (03.01.05)

How to Test

Step 1: Review System Security Plan

Examine the SSP for Least Privilege (03.01.05) implementation description and responsible parties.

Step 2: Assess Implementation

# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable

# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null

# For cloud:
# Use cloud-audit-mcp tools to assess posture

Step 3: CMMC Assessment Validation

Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.

Tools

Remediation Guide

Requirement Statement

Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks. Authorize access to [organization-defined] and [organization-defined]. Review the privileges assigned to roles or classes of users [organization-defined] to validate the need for such privileges. Reassign or remove privileges, as necessary.

Supplemental Guidance

Organizations employ the principle of least privilege for specific duties and authorized access for users and system processes. Least privilege is applied to the development, implementation, and operation of the system. Organizations consider creating additional processes, roles, and system accounts to achieve least privilege. Security functions include establishing system accounts and assigning privileges, installing software, configuring access authorizations, configuring settings for events to be audited, establishing vulnerability scanning parameters, establishing intrusion detection parameters, and managing audit information. Security-relevant information includes threat and vulnerability information, filtering rules for routers or firewalls, configuration parameters for security services, security architecture, cryptographic key management information, access control lists, and audit information.

Risk Assessment

CWE Categories

References

• NIST SP 800-171 Rev 3
• NIST SP 800-171A Rev 3 (Assessment)
• CMMC Model Overview
• NIST OSCAL Content

Checklist

• SSP documents Least Privilege (03.01.05) implementation
• Evidence of operating effectiveness collected
• POA&M addresses any gaps
• CMMC assessment objective met
• Continuous monitoring active