# AC-06 Least Privilege

NIST SP 800-53 control. Family: AC Access Control. Function: preventative. Baselines: moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
Guidance: Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.

## Enhancements (10)
- AC-06(01) Authorize Access to Security Functions. Baselines: moderate, high
- AC-06(02) Non-privileged Access for Nonsecurity Functions. Baselines: moderate, high
- AC-06(03) Network Access to Privileged Commands. Baselines: high
- AC-06(04) Separate Processing Domains
- AC-06(05) Privileged Accounts. Baselines: moderate, high
- AC-06(06) Privileged Access by Non-organizational Users
- AC-06(07) Review of User Privileges. Baselines: moderate, high
- AC-06(08) Privilege Levels for Code Execution
- AC-06(09) Log Use of Privileged Functions. Baselines: moderate, high
- AC-06(10) Prohibit Non-privileged Users from Executing Privileged Functions. Baselines: moderate, high
Each enhancement's statement: /api/v1/controls/AC-06?fields=enhancements

## Patterns that use it (24)
- Critical (13): SP-001 Client Module; SP-002 Server Module; SP-013 Data Security Pattern; SP-026 PCI Full Environment; SP-028 Secure DevOps Pipeline Pattern; SP-029 Zero Trust Architecture; SP-030 API Security; SP-037 Privileged User Management; SP-044 SaaS Identity Lifecycle Management; SP-047 Secure Agentic AI Frameworks; SP-051 Tokenised Asset Security Architecture (draft); SP-053 Zero-Knowledge Proof Architecture (draft); SP-054 CBDC and Digital Currency Infrastructure (draft)
- Important (10): SP-005 SOA Internal Service Usage Pattern; SP-015 Secure Remote Working; SP-016 DMZ Module; SP-023 Industrial Control Systems; SP-032 Modern Authentication; SP-033 Passkey Authentication; SP-035 Offensive Security Testing; SP-042 Third Party Risk Management; SP-045 AI Governance and Responsible AI; SP-050 Mobile Security Architecture (draft)
- Standard (1): SP-040 Post-Quantum Cryptography and Quantum Readiness

## Clauses by framework (83 frameworks)
- iso_27001_2022: A.5.15, A.5.18, A.8.2, A.8.3, A.8.18. OSA's own, not in NIST's crosswalk: A.5.18, A.8.3
- iso_27002_2022: 5.15, 5.18, 8.2, 8.3, 8.18
- cobit_2019: DSS05, DSS06
- pci_dss_v4: 3.4, 7.1, 7.2, 8.6
- nist_csf_2: PR.AA-05
- cis_controls_v8: CIS 3.3, CIS 3.14, CIS 5, CIS 5.4, CIS 6, CIS 6.1, CIS 6.8, CIS 12.8
- soc2_tsc: CC6.1, CC6.1-POF7
- finos_ccc: CCC-C11, CCC-C12
- iso_42001_2023: A.3.2, A.9.2
- iec_62443: 3-3 SR 1.3, 3-3 SR 2.1
- asd_e8: E8-5, E8-5 ML1, E8-5 ML2, E8-5 ML3, E8-8 ML3
- nis2: Art. 21(2)(i)
- apra_cps_234: Para 22-23
- mas_trm: 9
- bsi_grundschutz: OPS.1.1.2, ORP.4
- anssi: Hygiene.14, Hygiene.15, Hygiene.16, Hygiene.17, SecNumCloud.10.3, SecNumCloud.10.4
- osfi_b13: B-13.3.2
- finma_circular: IV.B.d(59), IV.B.d(60), IV.C(61)
- gdpr: Art.5(1)(c), Art.5(1)(f), Art.25(2), Art.32(1)(b)
- dora: Art.9(4)(c), Art.9(4)(d)
- bio2: 5.15, 5.18, 8.2, 8.3, 8.18
- rbi_csf: Annex1.8, ITGRCA.19
- fisc: FISC.T2
- lgpd_bcb: BCB.Art.3, LGPD.Art.6, LGPD.Art.46
- hkma_tme1: TME1.8.1, TME1.8.2
- mlps_2: 8.1.4.2, 8.1.5.1, 8.1.10.4
- dnb_good_practice: DNB.7.1, DNB.17.2
- cra: CRA.I.2d
- swift_cscf: SWIFT.1.2, SWIFT.5.1, SWIFT.6.3
- cbb_tm: TM-6
- cbuae: CR-4
- nca_ecc: 2-2
- qatar_nia: AC
- sama_csf: 3.1
- uae_ia: T9
- bog_cisd: CISD-VIII
- bom_ctrm: 3.3
- cbe_csf: CD-1, CTO-1
- cbn_csf: Part3.2, Part9
- popia: s10, s19
- sa_js2: JS2-7.1
- bcbs_239: Principle 11
- bot_cyber: Ch2.2
- cpmi_pfmi: CG.PR, PFMI.P17
- eba_ict: 3.4.2
- ecb_croe: CROE.2.3.1
- ffiec_is: II.C.7, II.C.7(b), II.C.13(a), II.C.15, II.C.15(a), II.C.15(b), II.C.18
- hipaa_sr: §164.308(a)(3)(i), §164.308(a)(3)(ii)(A), §164.308(a)(3)(ii)(B), §164.308(a)(4)(i), §164.308(a)(4)(ii)(B), §164.308(a)(4)(ii)(C), §164.312(a)(1), §164.314(b)(2)
- iosco_cyber: PROT-1
- nydfs_500: 500.6, 500.7
- sebi_cscrf: PR.AA
- cmmc_2: AC
- nrc_73_54: RG5.71-A-AC
- tsa_psd: SD-2 Sec B
- ieee_1686: 5.1
- doe_c2m2: ACCESS
- api_1164: Sec 6
- awia: AWWA Sec 3
- iaea_nss: Sec 5.3
- fips_140: FIPS 140-3 §7.4
- tiber_eu: TIBER.CONF
- pci_hsm: 1, 4, 5, 8
- common_criteria: CC Part 2 — FDP, CC Part 2 — FMT
- isae_3402: Clause 4
- fca_sysc_13: SYSC 13.6.2, SYSC 13.7.3
- fda_21_cfr_11: §11.10(d), §11.10(g)
- fda_cyber: SA-1, SA-4
- hitrust_csf: 01.a, 13.c, 13.e
- iso_27799: 9.1, 9.3, 9.5, H.4
- lloyds_ms: MS1.1, MS5.1, MS8.3
- naic_ds: 4-access, 4-audit, 4B
- nhs_dspt: NDG-1.1, NDG-4.1, NDG-4.4
- pra_ss1_23: P2.4, P3.3, P3.6, P4.4, P-IT.1
- solvency_ii: EIOPA-ICT-4.4
- owasp_masvs_v2: MASVS-PRIVACY-1
- csa_ccm_v4: IAM-04, IAM-05, IAM-08, IAM-09, IAM-10, IAM-11, IAM-16, LOG-04
- csa_aicm: IAM-04, IAM-05, IAM-08, IAM-09, IAM-10, IAM-11, IAM-16, IAM-18, IAM-19, LOG-04, MDS-07
- ccss_v9: 1.03.5, 1.04.3, 1.05.1, 1.05.3
- mica: Art.36(1), Art.40(1), Art.55(1), Art.63(1), Art.65(1), Art.67(1), Art.86(1), Art.92(1), Art.97(1)
- basel_sco60: SCO60.55, SCO60.61, SCO60.62, SCO60.64, SCO60.66, SCO60.72
- bssc: GSP-11, KMS-04, KMS-05, KMS-06, KMS-09, NOS-05, NOS-08, TIS-07
- sec_custody_digital: SEC-CD-02, SEC-CD-03, SEC-CD-04, SEC-CD-05, SEC-CD-16
- dpdpa: Act.8(5), Rules.6(1)(b), Rules.Sch1.B.7
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/AC-06
- Clauses only: /api/v1/controls/AC-06?fields=mappings
- Page for people: /controls/ac-06/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.