5.8.2.3
Implement Access Control and Authorization
Limit Administrator Privilege
Implement Access Control and Authorization – Limit Administrator Privilege – The organization shall only permit administrator accounts to perform administrative activities (and not user-level activities such as accessing email or browsing the web).
-
5.15 Access Control: Establish and implement access control rules for physical and logical access to the information based on business and security needs.
8.3 Information Access Restriction: Limit access to information and associated assets according to the established topic-specific access control policy.
-
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
3.1.2 Limit system access to the types
of transactions and functions that
authorized users are permitted to
execute.3.1.3 Control the flow of CUI in accordance with approved authorizations.
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.1.6 Use non-privileged accounts or roles when accessing nonsecurity functions.
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.1.12 Monitor and control remote access sessions.
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.8.2 Limit access to CUI on system media to authorized users.
3.9.1 Screen individuals prior to authorizing access to organizational systems containing CUI.
-
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
3.1.2 Limit system access to the types
of transactions and functions that
authorized users are permitted to
execute.3.1.3 Control the flow of CUI in accordance with approved authorizations.
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.1.6 Use non-privileged accounts or roles when accessing nonsecurity functions.
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.1.12 Monitor and control remote access sessions.
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.8.2 Limit access to CUI on system media to authorized users.
3.9.1 Screen individuals prior to authorizing access to organizational systems containing CUI.