3.1.7—Access Control - Derived
>Control Description
>Discussion
Privileged functions include establishing system accounts, performing system integrity checks, conducting patching operations, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.
Note that this requirement represents a condition to be achieved by the definition of authorized privileges in 3.1.2. Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Logging the use of privileged functions is one way to detect such misuse, and in doing so, help mitigate the risk from insider threats and the advanced persistent threat.
>Cross-Framework Mappings
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies prevent privileged users from executing non-privileged functions?
- •How do you define and separate privileged and non-privileged functions?
- •What governance ensures privileged accounts are purpose-specific?
- •How often are privileged account activities reviewed?
- •What process prevents privilege creep across different function types?
Technical Implementation:
- •How do you technically separate privileged and non-privileged functions?
- •What controls prevent privileged accounts from accessing email or web browsing?
- •How are administrative jump boxes or PAWs implemented?
- •What mechanisms enforce that privileged accounts only perform admin tasks?
- •How do you monitor privileged account activity for non-admin functions?
Evidence & Documentation:
- •Can you show privileged account usage logs excluding non-privileged activities?
- •What evidence demonstrates privileged accounts are limited to admin functions?
- •Can you provide examples of blocked non-privileged function attempts?
- •What audit reports verify separation of privileged and non-privileged use?
- •What documentation defines which functions are privileged vs non-privileged?
Ask AI
Configure your API key to use AI features.