NIST 800-171 3.1.5 (AC.L2-3.1.5): Least Privilege

What 3.1.5 means in practice

Give each account only the access its work needs, and be strictest with administrator accounts and security functions such as managing accounts, logging and keys. Assessors look for a short, named list of privileged accounts, access granted by role, and reviews that take away privileges nobody uses.

SPRS points and the CMMC POA&M

What an assessor checks for 3.1.5

NIST SP 800-171A gives 4 determination statements for 3.1.5, each found satisfied or other than satisfied. Determine if:

1. 3.1.5[a] privileged accounts are identified.
2. 3.1.5[b] access to privileged accounts is authorized in accordance with the principle of least privilege.
3. 3.1.5[c] security functions are identified.
4. 3.1.5[d] access to security functions is authorized in accordance with the principle of least privilege.

NIST SP 800-171A (June 2018), assessment objectives for 3.1.5

Evidence that shows 3.1.5 is met

• An inventory of privileged accounts with the person and the reason for each.
• Role definitions for security functions such as account management, logging and key management.
• Access reviews showing excess privileges were found and removed.
• Settings for time-limited or just-in-time elevation, where it is used.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.1.5 from it. Each line says what the product checks.

• Azure: Role assignments. Checks Azure role assignments for broad privileged roles where narrower built-in or custom roles would do.
• Okta: Directory. Counts Okta super administrators and flags more than four.
• AWS: IAM. Checks that no customer managed IAM policy grants full administrative access, that IAM principals carry no inline policies, and that the root account has no access keys.