Independent DIB implementation resource — not affiliated with or endorsed by the U.S. Department of WarView the official DoW campaign ↗
Brilliant at the BasicsDIB Resource Center
03.01.05OFFICIAL TITLEPENDING NIST SME REVIEW

03.01.05 — Least Privilege

03.01 Access Control · NIST SP 800-171 Rev. 3

Independent summary of the official requirement

Requires allowing only the system access necessary for users, and processes acting on their behalf, to accomplish assigned organizational tasks; authorizing access to organization-defined security functions and security-relevant information explicitly; and reviewing the privileges assigned to roles or classes of users on an organization-defined frequency, reassigning or removing privileges as needed (aligned to SP 800-53 AC-6).

Rev. 3 requirement text is multi-part and parameterized with organization-defined values, so this site summarizes rather than reproduces it. The summary is independent — read the official publication for the binding wording.

NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI ↗
Independent interpretation

What this requirement is after

Everyone gets what their job needs and nothing more — and someone re-checks that on a schedule, because privilege only ever accumulates. The practical work in a small environment is pruning: the ex-project permissions nobody removed, the 'temporary' admin grant from last year, the service account running as domain admin because it was easier.

Across revisions

Carried from 3.1.5, with the privileged-account and privileged-function specifics broken out into 03.01.06 and 03.01.07, and a periodic privilege review made explicit and parameterized.

Mapped practices

Brilliant at the Basics practices that support this requirement

Partial implementation supportModerate confidence

Why: Restricting production access to the people whose tasks require it is least privilege exercised on the OT estate — the practice's limiting function is the requirement's principle in that scope.

What this does not claim: The requirement adds machinery beyond limiting: explicit authorization for security functions and a privilege review on a defined cadence, which OT programs rarely run unprompted. Uptime pressure also pushes toward broad standing access for on-call engineers; that trade has to be documented and reviewed rather than silently accepted.

Practice-side activities
  • Scope engineering-tool and configuration access to named engineers
  • Run the periodic privilege review over OT accounts and record the reductions
Evidence this produces
  • Access matrices for OT systems by role
  • Dated OT privilege-review records

Review status: Pending NIST SME review · Reviewed by Brilliant at the Basics editorial — practitioner-authored; NIST SME review pending · updated 2026-08-06

Doing the work

Implementation considerations and evidence

Implementation considerationsIndependent guidance — tailor to your environment
  • Define which functions count as security functions — identity administration, log configuration, backup management — and gate access to them explicitly.
  • Run the privilege review on the defined cadence with the system owner in the room; a directory export nobody interprets is not a review.
  • Remove first and re-grant on request — reduction sticks better than case-by-case debate about whether an old privilege is still needed.
What operating evidence looks likeRecords worth retaining, not a submission checklist
  • The documented security-function access list and the defined review frequency
  • Dated privilege-review records showing reductions actually made
  • Before-and-after group membership exports for sampled reviews

Suggested owners, derived from the mapped practices and artifacts: Plant / OT leader · Identity admin · IT leader. Ownership is a named person in your organization, not a role on a website.

Artifacts

Templates and worksheets with a mapped relationship

INVENTORY · REVIEW QUARTERLYPrivileged Account InventoryWORKSHEET · REVIEW QUARTERLY FOR STANDARD ACCESS; MONTHLY FOR PRIVILEGEDPeriodic Access Review Worksheet
The other revision

Where this came from in Rev. 2

Provenance

Sources and review status

Primary sourcesNIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI
Review statusPending NIST SME review
Content version1.0
Updated