Back

Enforce privileged accounts and non-privileged accounts for system access.


CONTROL ID
00558
CONTROL TYPE
Technical Security
CLASSIFICATION
Preventive

SUPPORTING AND SUPPORTED CONTROLS



This Control directly supports the implied Control(s):
  • Secure access to each system component operating system., CC ID: 00551

This Control has the following implementation support Control(s):
  • Create a full text analysis on executed privileged functions., CC ID: 06778


SELECTED AUTHORITY DOCUMENTS COMPLIED WITH



  • The organization should implement functions to check the usage records of manager's cards (keys and IDs). (T47.1, FISC Security Guidelines on Computer Systems for Banking and Related Financial Institutions, 7th Edition)
  • Disallow non-administrator employees from installing software or changing security settings, except on a need-to basis. Keep administrator accounts for administrator use only. (Annex A2: Security of Personal Computers & Other Computing Devices 16, Singapore(PDPC) Guide to Securing Personal Data in Electronic Medium, Revised 20 January 2017)
  • Privileged access to systems, applications and data repositories is limited to that required for personnel to undertake their duties. (Security Control: 1508; Revision: 1, Australian Government Information Security Manual, March 2021)
  • Privileged users are assigned a dedicated privileged account to be used solely for tasks requiring privileged access. (Security Control: 0445; Revision: 6, Australian Government Information Security Manual, March 2021)
  • Privileged users use a dedicated administrator workstation when performing privileged tasks. (Security Control: 1380; Revision: 4, Australian Government Information Security Manual, March 2021)
  • Unique domain accounts with local administrative privileges, but without domain administrative privileges, are used for workstation and server management. (Security Control: 1469; Revision: 1, Australian Government Information Security Manual, March 2021)
  • Privileged users are assigned an unprivileged administration account for authenticating to their dedicated administrator workstations. (Security Control: 1382; Revision: 2, Australian Government Information Security Manual, March 2021)
  • When using a software-based isolation mechanism to share a physical server's hardware, the configuration of the isolation mechanism is hardened by removing unneeded functionality and restricting access to the administrative interface used to manage the isolation mechanism. (Security Control: 1604; Revision: 0, Australian Government Information Security Manual, March 2021)
  • Privileged users are assigned a dedicated privileged account to be used solely for tasks requiring privileged access. (Control: ISM-0445; Revision: 6, Australian Government Information Security Manual, June 2023)
  • Privileged users use separate privileged and unprivileged operating environments. (Control: ISM-1380; Revision: 5, Australian Government Information Security Manual, June 2023)
  • Unprivileged accounts cannot logon to privileged operating environments. (Control: ISM-1688; Revision: 0, Australian Government Information Security Manual, June 2023)
  • Privileged accounts (excluding local administrator accounts) cannot logon to unprivileged operating environments. (Control: ISM-1689; Revision: 0, Australian Government Information Security Manual, June 2023)
  • Dedicated service accounts are used to add machines to the domain. (Control: ISM-1842; Revision: 0, Australian Government Information Security Manual, June 2023)
  • Unique privileged accounts are used for administering individual server applications. (Control: ISM-1263; Revision: 4, Australian Government Information Security Manual, June 2023)
  • Microsoft AD DS domain controllers are administered using dedicated domain administrator user accounts that are not used to administer other systems. (Control: ISM-1827; Revision: 0, Australian Government Information Security Manual, June 2023)
  • Privileged users use separate privileged and unprivileged operating environments. (Control: ISM-1380; Revision: 5, Australian Government Information Security Manual, September 2023)
  • Unprivileged accounts cannot logon to privileged operating environments. (Control: ISM-1688; Revision: 0, Australian Government Information Security Manual, September 2023)
  • Privileged accounts (excluding local administrator accounts) cannot logon to unprivileged operating environments. (Control: ISM-1689; Revision: 0, Australian Government Information Security Manual, September 2023)
  • Dedicated service accounts are used to add machines to the domain. (Control: ISM-1842; Revision: 0, Australian Government Information Security Manual, September 2023)
  • Unique privileged accounts are used for administering individual server applications. (Control: ISM-1263; Revision: 4, Australian Government Information Security Manual, September 2023)
  • Microsoft AD DS domain controllers are administered using dedicated domain administrator user accounts that are not used to administer other systems. (Control: ISM-1827; Revision: 0, Australian Government Information Security Manual, September 2023)
  • Privileged users are assigned a dedicated privileged account to be used solely for duties requiring privileged access. (Control: ISM-0445; Revision: 7, Australian Government Information Security Manual, September 2023)
  • Database Administrator accounts must be used exclusively for administrative tasks and the general database user account must be used for general database interactions. (Control: 1263, Australian Government Information Security Manual: Controls)
  • The organization must assign System Administrators a separate account for performing administrative tasks. (Control: 0445 Bullet 2, Australian Government Information Security Manual: Controls)
  • The organization must use privileged accounts only for administrative work. (Control: 0445 Bullet 4, Australian Government Information Security Manual: Controls)
  • Users with administrative privileges should use an unprivileged account to send e-mail and browse the web. (Mitigation Strategy Effectiveness Ranking 3, Strategies to Mitigate Targeted Cyber Intrusions)
  • Are all administrative accounts (including service accounts) only used to perform legitimate administrative activities, with no access granted to external email or the Internet? (Access control Question 30, Cyber Essentials Scheme (CES) Questionnaire, Versions 3.3)
  • Does the administrative interface require second factor authentication or is access limited to a specific address? (Firewalls Question 8(a), Cyber Essentials Scheme (CES) Questionnaire, Versions 3.3)
  • Are system administrative access privileges restricted to a limited number of authorised individuals? (Access control Question 28, Cyber Essentials Scheme (CES) Questionnaire, Versions 3.3)
  • (§ 4.2.4.2, OGC ITIL: Security Management)
  • You closely manage privileged user access to networks and information systems supporting the essential function. (B2.c ¶ 1, NCSC CAF guidance, 3.1)
  • Title: Verify No UID 0 Accounts Exist Other Than root Description: Any account with UID 0 has superuser privileges on the system. Rationale: This access must be limited to only the default root account and only from the system console. Administrative access must be through an unprivileged accoun… (Rule: xccdf_org.cisecurity.benchmarks_rule_9.2.5_Verify_No_UID_0_Accounts_Exist_Other_Than_root Artifact Expression: xccdf_org.cisecurity.benchmarks_ae_9.2.5.1_etc.passwd.rootonlyuidzero, The Center for Internet Security CentOS 6 Level 1 Benchmark, 1.0.0)
  • Title: Verify No UID 0 Accounts Exist Other Than root Description: Any account with UID 0 has superuser privileges on the system. Rationale: This access must be limited to only the default root account and only from the system console. Administrative access must be through an unprivileged acco… (Rule:xccdf_org.cisecurity.benchmarks_rule_9.2.5_Verify_No_UID_0_Accounts_Exist_Other_Than_root Artifact Expression:xccdf_org.cisecurity.benchmarks_ae_9.2.5.1_etc.passwd.rootonlyuidzero, The Center for Internet Security Red Hat Enterprise Linux 6 Level 1 Benchmark, 1.2.0)
  • Title: Verify No UID 0 Accounts Exist Other Than root Description: Any account with UID 0 has superuser privileges on the system. Rationale: This access must be limited to only the default root account and only from the system console. Administrative access must be through an unprivileged acco… (Rule:xccdf_org.cisecurity.benchmarks_rule_9.2.5_Verify_No_UID_0_Accounts_Exist_Other_Than_root Artifact Expression:xccdf_org.cisecurity.benchmarks_ae_9.2.5.1_etc.passwd.rootonlyuidzero, The Center for Internet Security Red Hat Enterprise Linux 6 Level 2 Benchmark, 1.2.0)
  • Title: Verify No UID 0 Accounts Exist Other Than root Description: Any account with UID 0 has superuser privileges on the system. Rationale: This access must be limited to only the default root account and only from the system console. Administrative access must be through an unprivilege… (Rule: xccdf_org.cisecurity.benchmarks_rule_13.5_Verify_No_UID_0_Accounts_Exist_Other_Than_root Artifact Expression: xccdf_org.cisecurity.benchmarks_ae_13.5.1_etc.passwd.rootonlyuidzero, The Center for Internet Security Ubuntu 12.04 LTS Level 1 Benchmark, v1.0.0)
  • Title: Verify No UID 0 Accounts Exist Other Than root Description: Any account with UID 0 has superuser privileges on the system. Rationale: This access must be limited to only the default root account and only from the system console. Administrative access must be through an unprivilege… (Rule: xccdf_org.cisecurity.benchmarks_rule_13.5_Verify_No_UID_0_Accounts_Exist_Other_Than_root Artifact Expression: xccdf_org.cisecurity.benchmarks_ae_13.5.1_etc.passwd.rootonlyuidzero, The Center for Internet Security Ubuntu 12.04 LTS Level 2 Benchmark, v1.0.0)
  • Components shall provide an authorization enforcement mechanism for all identified and authenticated users based on their assigned responsibilities. (6.3.1 ¶ 1, IEC 62443-4-2: Security for industrial automation and control systems – Part 4-2: Technical security requirements for IACS components, Edition 1.0)
  • Examine a user ID list from a sample of system components to verify that system administration activities and other critical functions do not share the same User IDs. (Testing Procedures § 8.5.a Bullet 2, Payment Card Industry (PCI) Data Security Standard, Requirements and Security Assessment Procedures - Testing Procedures, 3)
  • Shared User IDs must not exist for System Administrators and other critical functions. (PCI DSS Requirements § 8.5 Bullet 2, Payment Card Industry (PCI) Data Security Standard, Requirements and Security Assessment Procedures, 3.0)
  • Are group, shared, or generic accounts, passwords, or other authentication methods prohibited by ensuring shared userIDs for system administration activities and other critical functions do not exist. (PCI DSS Question 8.5 Bullet 2, PCI DSS Self-Assessment Questionnaire A-EP and Attestation of Compliance, Version 3.0)
  • Are group, shared, or generic accounts, passwords, or other authentication methods prohibited by ensuring shared userIDs for system administration activities and other critical functions do not exist. (PCI DSS Question 8.5 Bullet 2, PCI DSS Self-Assessment Questionnaire B-IP and Attestation of Compliance, Version 3.0)
  • Are group, shared, or generic accounts, passwords, or other authentication methods prohibited by ensuring shared userIDs for system administration activities and other critical functions do not exist. (PCI DSS Question 8.5 Bullet 2, PCI DSS Self-Assessment Questionnaire D and Attestation of Compliance for Merchants, Version 3.0)
  • Are group, shared, or generic accounts, passwords, or other authentication methods prohibited by ensuring shared userIDs for system administration activities and other critical functions do not exist. (PCI DSS Question 8.5 Bullet 2, PCI DSS Self-Assessment Questionnaire D and Attestation of Compliance for Service Providers, Version 3.0)
  • Access privileges for application systems should be granted only in accordance with job requirements to ensure separation of duties have been implemented. (§ 5.3.3.1 ¶ 1, IIA Global Technology Audit Guide (GTAG) 1: Information Technology Controls)
  • The identity and access management (IAM) policy statement should include a section on the proper provisioning, administration, and enforcement of privileged accounts to prevent them from being unnecessarily or inappropriately accessed. (§ 3.3.2 (Granting Privileged Account Access to an Identity), IIA Global Technology Audit Guide (GTAG) 9: Identity and Access Management)
  • Administrators should be required to access a system using a fully logged and non-administrative account. Then, once logged on to the machine without administrative privileges, the administrator should transition to administrative privileges using tools such as Sudo on Linux/UNIX, RunAs on Windows, … (Control 5.8, The CIS Critical Security Controls for Effective Cyber Defense, Version 6.0)
  • The organization should require administrators to have separate, unique passwords for their non-administrator accounts and their administrator accounts. (Critical Control 12.8, Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines, Version 4.0)
  • The organization should assign a separate account for each person who requires administrative access. (Critical Control 12.8, Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines, Version 4.0)
  • The organization should block administrator-level account from accessing machines remotely or locally and should require the administrator to first log on with a non-administrative account and then sign on with the administrative account which has a different password than the non-administrative acc… (Critical Control 12.13, Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines, Version 4.0)
  • Utility programs capable of potentially overriding system, object, network, Virtual Machine and application controls shall be restricted. (IS-34, The Cloud Security Alliance Controls Matrix, Version 1.3)
  • Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities. (CIS Control 4: Sub-Control 4.3 Ensure the Use of Dedicated Administrative Accounts, CIS Controls, 7.1)
  • Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities. (CIS Control 4: Sub-Control 4.3 Ensure the Use of Dedicated Administrative Accounts, CIS Controls, V7)
  • The organization institutes strong controls over privileged system access by strictly limiting and closely supervising staff with elevated system access entitlements. (PR.AC-4.2, CRI Profile, v1.2)
  • When required and appropriate, one or more system components (software applications,embedded devices, host devices and network devices) shall provide the capability for the system to enforce the concept of least privilege. Individual system components shall provide the granularity of permissions and… (4.4 ¶ 1, Security for Industrial Automation and Control Systems, Part 4-2: Technical Security Requirements for IACS components)
  • In order to support IAC policies, as defined according to ISA‑62443‑2‑1[5], the component should verify the identity of all human users as a first step. In a second step, the permissions assigned to the identified human user should be enforced (see 6.3). (5.3.2 ¶ 3, Security for Industrial Automation and Control Systems, Part 4-2: Technical Security Requirements for IACS components)
  • Enforce the assigned privileges of an authenticated user (human, software process or device) to perform the requested action on the component and monitor the use of these privileges. (6.1 ¶ 1, Security for Industrial Automation and Control Systems, Part 4-2: Technical Security Requirements for IACS components)
  • Components shall provide an authorization enforcement mechanism for all identified and authenticated users based on their assigned responsibilities. (6.3.1 ¶ 1, Security for Industrial Automation and Control Systems, Part 4-2: Technical Security Requirements for IACS components)
  • SL 4 – Restrict use of the IACS according to specified privileges to protect against circumvention by entities using sophisticated means with extended resources, IACS specific skills and high motivation. (6.1 ¶ 1 Bullet 4, Security for Industrial Automation and Control Systems, Part 4-2: Technical Security Requirements for IACS components)
  • The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use nonprivileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, StateRAMP Security Controls Baseline Summary Category 3, Version 1.1)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10) ¶ 1, StateRAMP Security Controls Baseline Summary Category 3, Version 1.1)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10) ¶ 1, StateRAMP Security Controls Baseline Summary High Sensitivity Level, Version 1.1)
  • The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use nonprivileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, StateRAMP Security Controls Baseline Summary High Sensitivity Level, Version 1.1)
  • Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root. (M1026 Privileged Account Management, MITRE ATT&CK®, Enterprise Mitigations, Version 13.1)
  • Use non-privileged accounts or roles when accessing nonsecurity functions. (AC.2.008, Cybersecurity Maturity Model Certification, Version 1.0, Level 2)
  • Use non-privileged accounts or roles when accessing nonsecurity functions. (AC.2.008, Cybersecurity Maturity Model Certification, Version 1.0, Level 3)
  • Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. (AC.3.018, Cybersecurity Maturity Model Certification, Version 1.0, Level 3)
  • Use non-privileged accounts or roles when accessing nonsecurity functions. (AC.2.008, Cybersecurity Maturity Model Certification, Version 1.0, Level 4)
  • Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. (AC.3.018, Cybersecurity Maturity Model Certification, Version 1.0, Level 4)
  • Use non-privileged accounts or roles when accessing nonsecurity functions. (AC.2.008, Cybersecurity Maturity Model Certification, Version 1.0, Level 5)
  • Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. (AC.3.018, Cybersecurity Maturity Model Certification, Version 1.0, Level 5)
  • Use non-privileged accounts or roles when accessing nonsecurity functions. (AC.L2-3.1.6 Non-Privileged Account Use, Cybersecurity Maturity Model Certification, Version 2.0, Level 2)
  • Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. (AC.L2-3.1.7 Privileged Functions, Cybersecurity Maturity Model Certification, Version 2.0, Level 2)
  • Privileged users must use non-privileged accounts for non-privileged functions and privileged accounts for privileged functions. (ECLP-1, DoD Instruction 8500.2 Information Assurance (IA) Implementation)
  • Only privileged users may access privileged accounts. (ECLP-1, DoD Instruction 8500.2 Information Assurance (IA) Implementation)
  • The information system shall enforce assigned authorizations for controlling access to the system and contained information. The information system controls shall restrict access to privileged functions (deployed in hardware, software, and firmware) and security-relevant information to explicitly au… (§ 5.5.2 ¶ 1, Criminal Justice Information Services (CJIS) Security Policy, CJISD-ITS-DOC-08140-5.8, Version 5.8)
  • The information system shall enforce assigned authorizations for controlling access to the system and contained information. The information system controls shall restrict access to privileged functions (deployed in hardware, software, and firmware) and security-relevant information to explicitly au… (§ 5.5.2 ¶ 1, Criminal Justice Information Services (CJIS) Security Policy, CJISD-ITS-DOC-08140-5.9.1, Version 5.9.1)
  • Elevated privileges are monitored. (Domain 3: Assessment Factor: Detective Controls, ANOMALOUS ACTIVITY DETECTION Baseline 2 ¶ 5, FFIEC Cybersecurity Assessment Tool, Baseline, May 2017)
  • Restricts administrative access to this type of software. (App A Objective 13:6e Bullet 2, FFIEC Information Technology Examination Handbook - Architecture, Infrastructure, and Operations, June 2021)
  • Application controls should be incorporated directly into individual computer applications to provide reasonable assurance of accurate and reliable processing. Application controls address three major operations—data input, data processing and data output. (§ 295F.05, GAO/PCIE Financial Audit Manual (FAM))
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10) High Baseline Controls, FedRAMP Baseline Security Controls, 8/28/2018)
  • The organization requires that users of information system accounts, or roles, with access to [FedRAMP Assignment: all security functions], use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) High Baseline Controls, FedRAMP Baseline Security Controls, 8/28/2018)
  • The organization requires that users of information system accounts, or roles, with access to [FedRAMP Assignment: all security functions], use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) Moderate Baseline Controls, FedRAMP Baseline Security Controls, 8/28/2018)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10) Moderate Baseline Controls, FedRAMP Baseline Security Controls, 8/28/2018)
  • Prevent non-privileged users from executing privileged functions. (AC-6(10) ¶ 1, FedRAMP Security Controls High Baseline, Version 5)
  • Require that users of system accounts (or roles) with access to [FedRAMP Assignment: all security functions] use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, FedRAMP Security Controls High Baseline, Version 5)
  • Prevent non-privileged users from executing privileged functions. (AC-6(10) ¶ 1, FedRAMP Security Controls Moderate Baseline, Version 5)
  • Require that users of system accounts (or roles) with access to [FedRAMP Assignment: all security functions] use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, FedRAMP Security Controls Moderate Baseline, Version 5)
  • Does the System Administrator use a password that is unique from other access passwords? (IT - General Q 18, Automated Integrated Regulatory Examination System (AIRES) IT Exam Questionnaires, version 073106A)
  • Prevent non-privileged users from executing privileged functions. (AC-6(10) ¶ 1, Control Baselines for Information Systems and Organizations, NIST SP 800-53B, High Impact Baseline, October 2020)
  • Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, Control Baselines for Information Systems and Organizations, NIST SP 800-53B, High Impact Baseline, October 2020)
  • Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, Control Baselines for Information Systems and Organizations, NIST SP 800-53B, Moderate Impact Baseline, October 2020)
  • Prevent non-privileged users from executing privileged functions. (AC-6(10) ¶ 1, Control Baselines for Information Systems and Organizations, NIST SP 800-53B, Moderate Impact Baseline, October 2020)
  • Prohibit privileged access to the system by non-organizational users. (AC-6(6) ¶ 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, NIST Special Publication 800-161, Revision 1, Appendix A, C-SCRM Level 2 Controls)
  • Prohibit privileged access to the system by non-organizational users. (AC-6(6) ¶ 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, NIST Special Publication 800-161, Revision 1, Appendix A, C-SCRM Level 3 Controls)
  • Calls for Access Control (AC): Organizations must limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) and to the types of transactions and functions that authorized users are permitted to exercise. (§ 3, FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006)
  • (§ 3.12.1, § 3.12.2, Generally Accepted Principles and Practices for Securing Information Technology Systems, NIST SP 800-14, September 1996)
  • Organizational records and documents should be examined to ensure user access and privileges are authorized; the system is configured correctly to enforce the access control policy; access to the system is controlled on a continual basis; user functionality is separated by physical and/or logical me… (AC-3, SC-2, SC-3, SC-3(1), SC-3(2), SC-3(3), SC-3(4), SC-3(5), SC-4, Guide for Assessing the Security Controls in Federal Information Systems, NIST SP 800-53A)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10) ¶ 1 High Baseline Controls, Guide to Industrial Control Systems (ICS) Security, Revision 2)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10) ¶ 1 Moderate Baseline Controls, Guide to Industrial Control Systems (ICS) Security, Revision 2)
  • The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1 Moderate Baseline Controls, Guide to Industrial Control Systems (ICS) Security, Revision 2)
  • The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1 High Baseline Controls, Guide to Industrial Control Systems (ICS) Security, Revision 2)
  • Access to cluster-wide administrative accounts should be tightly controlled as these accounts provide ability to affect all resources in the environment. Organizations should use strong authentication methods, such as requiring multifactor authentication instead of just a password. (4.3.2 ¶ 1, NIST SP 800-190, Application Container Security Guide)
  • Use non-privileged accounts or roles when accessing nonsecurity functions. (3.1.6, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, NIST Special Publication 800-171)
  • Prevent non-privileged users from executing privileged functions and audit the execution of such functions. (3.1.7, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, NIST Special Publication 800-171)
  • Use non-privileged accounts or roles when accessing nonsecurity functions. (3.1.6, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, NIST Special Publication 800-171, Revision 1)
  • Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. (3.1.7, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, NIST Special Publication 800-171, Revision 1)
  • Use non-privileged accounts or roles when accessing nonsecurity functions. (3.1.6, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, NIST Special Publication 800-171, Revision 2)
  • Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. (3.1.7, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, NIST Special Publication 800-171, Revision 2)
  • The organization should protect the audit records of non-local access to privileged accounts and the execution of privileged functions. (App F § AU-9(4)(b), Recommended Security Controls for Federal Information Systems, NIST SP 800-53)
  • Administer accounts, network rights, and access to systems and equipment. (T0494, Reference Spreadsheet for the Workforce Framework for Cybersecurity (NICE Framework)”, July 7, 2020)
  • The organization requires that users of information system accounts, or roles, with access to {organizationally documented security functions}, use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2), Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Deprecated, Revision 4, Deprecated)
  • The organization requires that users of information system accounts, or roles, with access to {organizationally documented security-relevant information}, use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2), Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Deprecated, Revision 4, Deprecated)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10), Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Deprecated, Revision 4, Deprecated)
  • The organization requires that users of information system accounts, or roles, with access to {organizationally documented security functions}, use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2), Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, High Impact Baseline, Deprecated, Revision 4, Deprecated)
  • The organization requires that users of information system accounts, or roles, with access to {organizationally documented security-relevant information}, use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2), Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, High Impact Baseline, Deprecated, Revision 4, Deprecated)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10), Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, High Impact Baseline, Deprecated, Revision 4, Deprecated)
  • The organization requires that users of information system accounts, or roles, with access to {organizationally documented security functions}, use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2), Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Moderate Impact Baseline, Deprecated, Revision 4, Deprecated)
  • The organization requires that users of information system accounts, or roles, with access to {organizationally documented security-relevant information}, use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2), Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Moderate Impact Baseline, Deprecated, Revision 4, Deprecated)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10), Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Moderate Impact Baseline, Deprecated, Revision 4, Deprecated)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10) ¶ 1, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, High Impact Baseline, Revision 4)
  • The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use nonprivileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, High Impact Baseline, Revision 4)
  • The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use nonprivileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Moderate Impact Baseline, Revision 4)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10) ¶ 1, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Moderate Impact Baseline, Revision 4)
  • The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use nonprivileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Revision 4)
  • The organization prohibits privileged access to the information system by non-organizational users. (AC-6(6) ¶ 1, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Revision 4)
  • The information system detects [Assignment: organization-defined unauthorized operating system commands] through the kernel application programming interface at [Assignment: organization-defined information system hardware components] and [Selection (one or more): issues a warning; audits the comman… (SI-3(8) ¶ 1, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Revision 4)
  • Restricts the use of the manual override capability to only [Assignment: organization-defined authorized individuals]; and (SI-10(1)(b), Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Revision 4)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10) ¶ 1, Security and Privacy Controls for Federal Information Systems and Organizations, NIST SP 800-53, Revision 4)
  • Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5)
  • Prohibit privileged access to the system by non-organizational users. (AC-6(6) ¶ 1, Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5)
  • Prevent non-privileged users from executing privileged functions. (AC-6(10) ¶ 1, Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5)
  • [Selection (one or more): issue a warning; audit the command execution; prevent the execution of the command]. (SI-3(8)(b), Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5)
  • Restrict the use of the manual override capability to only [Assignment: organization-defined authorized individuals]; and (SI-10(1)(b), Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5)
  • Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5.1.1)
  • Prohibit privileged access to the system by non-organizational users. (AC-6(6) ¶ 1, Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5.1.1)
  • Prevent non-privileged users from executing privileged functions. (AC-6(10) ¶ 1, Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5.1.1)
  • [Selection (one or more): issue a warning; audit the command execution; prevent the execution of the command]. (SI-3(8)(b), Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5.1.1)
  • Restrict the use of the manual override capability to only [Assignment: organization-defined authorized individuals]; and (SI-10(1)(b), Security and Privacy Controls for Information Systems and Organizations, NIST SP 800-53, Revision 5.1.1)
  • The organization prohibits privileged access to the information system by non-organizational users. (AC-6(6) ¶ 1, Supply Chain Risk Management Practices for Federal Information Systems and Organizations, NIST Special Publication 800-161, April 2015)
  • Establish and enforce unique accounts for each individual user and administrator, establish security requirements for certain types of privileged accounts, and prohibit the sharing of these accounts. (Table 2: Access Control Baseline Security Measures Cell 1 ¶ 1, Pipeline Security Guidelines)
  • limit the number of privileged accounts and limit the access functions of privileged accounts to only those necessary to perform the user's job; (§ 500.7 Access Privileges and Management (a)(2), New York Codes, Rules and Regulations, Title 23, Chapter 1, Part 500 Cybersecurity Requirements for Financial Services Companies, Second Amendment)
  • limit the use of privileged accounts to only when performing functions requiring the use of such access; (§ 500.7 Access Privileges and Management (a)(3), New York Codes, Rules and Regulations, Title 23, Chapter 1, Part 500 Cybersecurity Requirements for Financial Services Companies, Second Amendment)
  • The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. (AC-6(10) ¶ 1, TX-RAMP Security Controls Baseline Level 2)
  • The organization requires that users of information system accounts, or roles, with access to [TX-RAMP Assignment: all security functions], use nonprivileged accounts or roles, when accessing nonsecurity functions. (AC-6(2) ¶ 1, TX-RAMP Security Controls Baseline Level 2)