CMMC Practice AC.L2-3.1.7

Privileged Functions: Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Monarch ISC Guidance

There are a couple of things going on here: first, you can't give everyone in your organization administrative rights. This includes removing these rights at the workstation level. Many organizations have allowed users to retain what is referred to as "local administrative privileges" at the workstation level to reduce overhead on the IT Staff for installing software and approving changes. That is not a good cyber-security practice as it also allows malicious software to be easily installed and take control of the workstations. It allows the installation of unapproved software making tracking of approved software harder on IT. Second, you must employ a system which captures audit logs, detects the use of administrative functions, and sends an alert or provides regular reports for review when this has happened.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

NIST SP 800-171 R2 Privileged functions include establishing system accounts, performing system integrity checks, conducting patching operations, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. Note that this requirement represents a condition to be achieved by the definition of authorized privileges in 3.1.2 (AC.L2-3.1.2). Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Logging the use of privileged functions is one way to detect such misuse, and in doing so, help mitigate the risk from insider threats and the advanced persistent threat.