| name | Least Privilege (03.01.05)_least-privilege |
| description | Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks. |
| category | authorization |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-171","rev3","least privilege (03-01-05)","family-03.01","cui-protection","cmmc"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-284"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Least Privilege (03.01.05) Least Privilege
High-Level Description
Family: Access Control
Framework: NIST SP 800-171 Rev 3
Applicability: Systems processing, storing, or transmitting CUI
Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks.
Authorize access to [organization-defined] and [organization-defined].
Review the privileges assigned to roles or classes of users [organization-defined] to validate the need for such privileges.
Reassign or remove privileges, as necessary.
What to Check
How to Test
Step 1: Review System Security Plan
Examine the SSP for Least Privilege (03.01.05) implementation description and responsible parties.
Step 2: Assess Implementation
# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable
# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null
# For cloud:
# Use cloud-audit-mcp tools to assess posture
Step 3: CMMC Assessment Validation
Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Assess cloud CUI environment | cloud_audit_* tools |
| Manual Review | SSP and POA&M review | Documentation analysis |
Remediation Guide
Requirement Statement
Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks.
Authorize access to [organization-defined] and [organization-defined].
Review the privileges assigned to roles or classes of users [organization-defined] to validate the need for such privileges.
Reassign or remove privileges, as necessary.
