5.8.2.1
Minimum Functionality
The organization shall provision accounts with the minimum functionality necessary for tasks and shall restrict administrator privileges to an as-required basis.
-
5.15 Access Control: Establish and implement access control rules for physical and logical access to the information based on business and security needs.
5.17 Authentication Information: Control authentication information allocation and management through a managed process, including recommendation on the appropriate handling.
8.3 Information Access Restriction: Limit access to information and associated assets according to the established topic-specific access control policy.
-
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
3.1.2 Limit system access to the types
of transactions and functions that
authorized users are permitted to
execute.3.1.3 Control the flow of CUI in accordance with approved authorizations.
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.1.6 Use non-privileged accounts or roles when accessing nonsecurity functions.
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.1.12 Monitor and control remote access sessions.
3.1.15 Authorize remote execution of privileged commands and remote access to security-relevant information.
3.1.16 Authorize wireless access prior to allowing such connections.
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
3.8.2 Limit access to CUI on system media to authorized users.
3.9.1 Screen individuals prior to authorizing access to organizational systems containing CUI.
-
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
3.1.2 Limit system access to the types
of transactions and functions that
authorized users are permitted to
execute.3.1.3 Control the flow of CUI in accordance with approved authorizations.
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.1.6 Use non-privileged accounts or roles when accessing nonsecurity functions.
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
3.1.12 Monitor and control remote access sessions.
3.1.15 Authorize remote execution of privileged commands and remote access to security-relevant information.
3.1.16 Authorize wireless access prior to allowing such connections.
3.4.5 Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
3.4.6 Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
3.8.2 Limit access to CUI on system media to authorized users.
3.9.1 Screen individuals prior to authorizing access to organizational systems containing CUI.