- Remove local administrator rights from standard users; handle exceptions with elevation tooling or documented, expiring grants.
- Turn on and centralize audit logging for the admin planes you actually use — directory, endpoint management, firewall, hypervisor.
- Alert when a non-privileged identity executes a privileged function; that event is either an enforcement failure or an intrusion.
03.01.07OFFICIAL TITLEPENDING NIST SME REVIEW
03.01.07 — Least Privilege — Privileged Functions
03.01 Access Control · NIST SP 800-171 Rev. 3
Independent summary of the official requirement
Requires preventing non-privileged users from executing privileged functions and logging the execution of privileged functions (aligned to SP 800-53 AC-6(9) and AC-6(10)).
Rev. 3 requirement text is multi-part and parameterized with organization-defined values, so this site summarizes rather than reproduces it. The summary is independent — read the official publication for the binding wording.
NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
Ordinary users must be technically unable to do admin things — install software, change security settings, alter logs — and every admin action must leave a record. In small environments the first half usually fails through local admin rights handed out to reduce helpdesk tickets, and the second half through admin consoles whose audit trail was never switched on.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- Endpoint policy showing standard users without administrative rights
- Log samples of privileged actions with actor, action, and timestamp
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this came from in Rev. 2
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |