Employ the principle of least privilege
📖 What This Means
The principle of least privilege means giving users and systems only the minimum access they need to perform their job functions. This reduces the risk of accidental or intentional misuse of sensitive information. For example, an employee in the HR department should have access to personnel files but not financial records. Similarly, a web server should have access to its own application files but not to the entire server's file system. This control is crucial for protecting Controlled Unclassified Information (CUI) and ensuring that access is tightly controlled.
🎯 Why It Matters
Without least privilege, users and systems may have excessive access, increasing the risk of data breaches, insider threats, and malware spreading. For instance, in the 2017 Equifax breach, hackers exploited a vulnerability in a web application that had excessive privileges, leading to the exposure of 147 million records. The DoD emphasizes least privilege to protect CUI and ensure that only authorized personnel can access sensitive information. Implementing least privilege minimizes the attack surface and limits potential damage from compromised accounts.
✅ How to Implement
- 1. Use Identity and Access Management (IAM) roles in AWS, Azure, or GCP to define granular permissions.
- 2. Regularly review and update IAM policies to ensure they align with job functions.
- 3. Implement role-based access control (RBAC) in cloud environments.
- 4. Use Azure AD Privileged Identity Management (PIM) or AWS IAM Access Analyzer to monitor and manage permissions.
- 5. Enable Just-In-Time (JIT) access for privileged accounts.
- 6. Use cloud-native tools to enforce least privilege for service accounts.
- 7. Regularly audit permissions using cloud provider's access reports.
📋 Evidence Examples
IAM Policy Document
Access Control Policy
Permission Audit Report
Training Records
Configuration Screenshots
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For AC.L2-3.1.5 ("Employ the principle of least privilege"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how access to CUI systems is controlled, including the specific IAM tools, policies, and processes used. Reference your Access Control Policy and identify the systems in scope. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"AC.L2-3.1.5 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to employ the principle of least privilege. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"AC.L2-3.1.5 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to employ the principle of least privilege. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"AC.L2-3.1.5 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all access points to CUI systems (VPN, direct network, cloud portals)
- • Document which IAM system manages access (Azure AD, AWS IAM, on-prem AD)
- • Map user roles to system access levels
- • Ensure this control covers all systems within your defined CUI boundary where employ the principle of least privilege applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Access Control Policy
- 📄 IAM configuration documentation
- 📄 Access request and approval records
- 📄 Evidence artifacts specific to AC.L2-3.1.5
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will verify that access controls are implemented as described, test whether unauthorized users are blocked, and review access logs for evidence of enforcement.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you have a documented access control policy that enforces least privilege?
Question 2: Are user permissions regularly reviewed and updated based on job roles?
Question 3: Are administrative privileges restricted and separate from regular user accounts?
Question 4: Do you use RBAC to manage permissions in your environment?
Question 5: Are permissions regularly audited and documented?
⚠️ Common Mistakes (What Auditors Flag)
1. Over-privileged accounts
2. No separate admin accounts
3. Inconsistent permissions across environments
4. Missing access control policy
5. Insufficient training
📚 Parent Policy
This practice is governed by the Access Control Policy