AC-6(7)—Least Privilege (7)

Review annually the privileges assigned to non-privileged and privileged users to validate the need for such privileges; and

Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.