AC-06 Least Privilege
Access Control
Moderate High
Description
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
Supplemental Guidance
Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege. Organizations apply least privilege to the development, implementation, and operation of organizational systems.
Enhancements (10)
What NIST adds to this control. Select one to read its statement.
AC-06(01) Authorize Access to Security Functions ModerateHigh
Authorize access for [Assignment: organization-defined individuals or roles] to: a. [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)]; and b. [Assignment: organization-defined security-relevant information].
AC-06(02) Non-privileged Access for Nonsecurity Functions ModerateHigh
Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions.
AC-06(03) Network Access to Privileged Commands High
Authorize network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and document the rationale for such access in the security plan for the system.
AC-06(04) Separate Processing Domains
Provide separate processing domains to enable finer-grained allocation of user privileges.
AC-06(05) Privileged Accounts ModerateHigh
Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].
AC-06(06) Privileged Access by Non-organizational Users
Prohibit privileged access to the system by non-organizational users.
AC-06(07) Review of User Privileges ModerateHigh
a. Review [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and b. Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.
AC-06(08) Privilege Levels for Code Execution
Prevent the following software from executing at higher privilege levels than users executing the software: [Assignment: organization-defined software].
AC-06(09) Log Use of Privileged Functions ModerateHigh
Log the execution of privileged functions.
AC-06(10) Prohibit Non-privileged Users from Executing Privileged Functions ModerateHigh
Prevent non-privileged users from executing privileged functions.
Patterns that use this control (24)
Grouped by the emphasis each pattern gives it.
Critical (13)
- SP-001 Client Module
- SP-002 Server Module
- SP-013 Data Security Pattern
- SP-026 PCI Full Environment
- SP-028 Secure DevOps Pipeline Pattern
- SP-029 Zero Trust Architecture
- SP-030 API Security
- SP-037 Privileged User Management
- SP-044 SaaS Identity Lifecycle Management
- SP-047 Secure Agentic AI Frameworks
- SP-051 Tokenised Asset Security Architecture (draft)
- SP-053 Zero-Knowledge Proof Architecture (draft)
- SP-054 CBDC and Digital Currency Infrastructure (draft)
Important (10)
- SP-005 SOA Internal Service Usage Pattern
- SP-015 Secure Remote Working
- SP-016 DMZ Module
- SP-023 Industrial Control Systems
- SP-032 Modern Authentication
- SP-033 Passkey Authentication
- SP-035 Offensive Security Testing
- SP-042 Third Party Risk Management
- SP-045 AI Governance and Responsible AI
- SP-050 Mobile Security Architecture (draft)
MITRE ATT&CK Techniques (270)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.
Initial Access 13 Execution 32 Persistence 81 Privilege Escalation 72 Defense Evasion 99 Credential Access 44 Discovery 6 Lateral Movement 18 Collection 11 Exfiltration 9 Impact 13
Show all 270 techniques grouped by tactic
Initial Access
T1078 Valid Accounts T1091 Replication Through Removable Media T1133 External Remote Services T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1195 Supply Chain Compromise T1199 Trusted Relationship T1200 Hardware Additions T1078.001 Default Accounts T1078.002 Domain Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1566.003 Spearphishing via Service
Execution
T1047 Windows Management Instrumentation T1053 Scheduled Task/Job T1059 Command and Scripting Interpreter T1072 Software Deployment Tools T1106 Native API T1203 Exploitation for Client Execution T1559 Inter-Process Communication T1569 System Services T1609 Container Administration Command T1610 Deploy Container T1648 Serverless Execution T1651 Cloud Administration Command T1053.002 At T1053.003 Cron T1053.005 Scheduled Task T1053.006 Systemd Timers T1053.007 Container Orchestration Job T1059.001 PowerShell T1059.002 AppleScript T1059.003 Windows Command Shell T1059.004 Unix Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1059.008 Network Device CLI T1059.009 Cloud API T1059.010 AutoHotKey & AutoIT T1059.011 Lua T1559.001 Component Object Model T1559.002 Dynamic Data Exchange T1569.001 Launchctl T1569.002 Service Execution
Persistence
T1053 Scheduled Task/Job T1078 Valid Accounts T1098 Account Manipulation T1133 External Remote Services T1136 Create Account T1137 Office Application Startup T1176 Browser Extensions T1197 BITS Jobs T1505 Server Software Component T1525 Implant Internal Image T1542 Pre-OS Boot T1543 Create or Modify System Process T1546 Event Triggered Execution T1556 Modify Authentication Process T1574 Hijack Execution Flow T1053.002 At T1053.003 Cron T1053.005 Scheduled Task T1053.006 Systemd Timers T1053.007 Container Orchestration Job T1078.001 Default Accounts T1078.002 Domain Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1098.001 Additional Cloud Credentials T1098.002 Additional Email Delegate Permissions T1098.003 Additional Cloud Roles T1098.004 SSH Authorized Keys T1098.005 Device Registration T1098.006 Additional Container Cluster Roles T1098.007 Additional Local or Domain Groups T1136.001 Local Account T1136.002 Domain Account T1136.003 Cloud Account T1137.001 Office Template Macros T1137.002 Office Test T1137.003 Outlook Forms T1137.004 Outlook Home Page T1137.005 Outlook Rules T1137.006 Add-ins T1505.002 Transport Agent T1505.003 Web Shell T1505.004 IIS Components T1505.005 Terminal Services DLL T1542.001 System Firmware T1542.003 Bootkit T1542.004 ROMMONkit T1542.005 TFTP Boot T1543.001 Launch Agent T1543.002 Systemd Service T1543.003 Windows Service T1543.004 Launch Daemon T1543.005 Container Service T1546.003 Windows Management Instrumentation Event Subscription T1546.004 Unix Shell Configuration Modification T1546.011 Application Shimming T1546.013 PowerShell Profile T1546.016 Installer Packages T1547.003 Time Providers T1547.004 Winlogon Helper DLL T1547.006 Kernel Modules and Extensions T1547.009 Shortcut Modification T1547.012 Print Processors T1547.013 XDG Autostart Entries T1556.001 Domain Controller Authentication T1556.003 Pluggable Authentication Modules T1556.004 Network Device Authentication T1556.005 Reversible Encryption T1556.006 Multi-Factor Authentication T1556.007 Hybrid Identity T1556.008 Network Provider DLL T1556.009 Conditional Access Policies T1574.004 Dylib Hijacking T1574.005 Executable Installer File Permissions Weakness T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.010 Services File Permissions Weakness T1574.011 Services Registry Permissions Weakness T1574.012 COR_PROFILER T1574.014 AppDomainManager
Privilege Escalation
T1053 Scheduled Task/Job T1055 Process Injection T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1098 Account Manipulation T1134 Access Token Manipulation T1484 Domain or Tenant Policy Modification T1543 Create or Modify System Process T1546 Event Triggered Execution T1548 Abuse Elevation Control Mechanism T1574 Hijack Execution Flow T1611 Escape to Host T1053.002 At T1053.003 Cron T1053.005 Scheduled Task T1053.006 Systemd Timers T1053.007 Container Orchestration Job T1055.001 Dynamic-link Library Injection T1055.002 Portable Executable Injection T1055.003 Thread Execution Hijacking T1055.004 Asynchronous Procedure Call T1055.005 Thread Local Storage T1055.008 Ptrace System Calls T1055.009 Proc Memory T1055.011 Extra Window Memory Injection T1055.012 Process Hollowing T1055.013 Process Doppelgänging T1055.014 VDSO Hijacking T1078.001 Default Accounts T1078.002 Domain Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1098.001 Additional Cloud Credentials T1098.002 Additional Email Delegate Permissions T1098.003 Additional Cloud Roles T1098.004 SSH Authorized Keys T1098.005 Device Registration T1098.006 Additional Container Cluster Roles T1098.007 Additional Local or Domain Groups T1134.001 Token Impersonation/Theft T1134.002 Create Process with Token T1134.003 Make and Impersonate Token T1134.005 SID-History Injection T1543.001 Launch Agent T1543.002 Systemd Service T1543.003 Windows Service T1543.004 Launch Daemon T1543.005 Container Service T1546.003 Windows Management Instrumentation Event Subscription T1546.004 Unix Shell Configuration Modification T1546.011 Application Shimming T1546.013 PowerShell Profile T1546.016 Installer Packages T1547.003 Time Providers T1547.004 Winlogon Helper DLL T1547.006 Kernel Modules and Extensions T1547.009 Shortcut Modification T1547.012 Print Processors T1547.013 XDG Autostart Entries T1548.002 Bypass User Account Control T1548.003 Sudo and Sudo Caching T1548.005 Temporary Elevated Cloud Access T1548.006 TCC Manipulation T1574.004 Dylib Hijacking T1574.005 Executable Installer File Permissions Weakness T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.010 Services File Permissions Weakness T1574.011 Services Registry Permissions Weakness T1574.012 COR_PROFILER T1574.014 AppDomainManager
Defense Evasion
T1036 Masquerading T1055 Process Injection T1070 Indicator Removal T1078 Valid Accounts T1112 Modify Registry T1134 Access Token Manipulation T1197 BITS Jobs T1211 Exploitation for Defense Evasion T1218 System Binary Proxy Execution T1222 File and Directory Permissions Modification T1484 Domain or Tenant Policy Modification T1542 Pre-OS Boot T1548 Abuse Elevation Control Mechanism T1550 Use Alternate Authentication Material T1553 Subvert Trust Controls T1556 Modify Authentication Process T1562 Impair Defenses T1574 Hijack Execution Flow T1578 Modify Cloud Compute Infrastructure T1599 Network Boundary Bridging T1601 Modify System Image T1610 Deploy Container T1612 Build Image on Host T1647 Plist File Modification T1036.003 Rename System Utilities T1036.005 Match Legitimate Name or Location T1055.001 Dynamic-link Library Injection T1055.002 Portable Executable Injection T1055.003 Thread Execution Hijacking T1055.004 Asynchronous Procedure Call T1055.005 Thread Local Storage T1055.008 Ptrace System Calls T1055.009 Proc Memory T1055.011 Extra Window Memory Injection T1055.012 Process Hollowing T1055.013 Process Doppelgänging T1055.014 VDSO Hijacking T1070.001 Clear Windows Event Logs T1070.002 Clear Linux or Mac System Logs T1070.003 Clear Command History T1070.007 Clear Network Connection History and Configurations T1070.008 Clear Mailbox Data T1070.009 Clear Persistence T1078.001 Default Accounts T1078.002 Domain Accounts T1078.003 Local Accounts T1078.004 Cloud Accounts T1134.001 Token Impersonation/Theft T1134.002 Create Process with Token T1134.003 Make and Impersonate Token T1134.005 SID-History Injection T1218.007 Msiexec T1218.015 Electron Applications T1222.001 Windows File and Directory Permissions Modification T1222.002 Linux and Mac File and Directory Permissions Modification T1542.001 System Firmware T1542.003 Bootkit T1542.004 ROMMONkit T1542.005 TFTP Boot T1548.002 Bypass User Account Control T1548.003 Sudo and Sudo Caching T1548.005 Temporary Elevated Cloud Access T1548.006 TCC Manipulation T1550.002 Pass the Hash T1550.003 Pass the Ticket T1553.003 SIP and Trust Provider Hijacking T1553.006 Code Signing Policy Modification T1556.001 Domain Controller Authentication T1556.003 Pluggable Authentication Modules T1556.004 Network Device Authentication T1556.005 Reversible Encryption T1556.006 Multi-Factor Authentication T1556.007 Hybrid Identity T1556.008 Network Provider DLL T1556.009 Conditional Access Policies T1562.001 Disable or Modify Tools T1562.002 Disable Windows Event Logging T1562.004 Disable or Modify System Firewall T1562.006 Indicator Blocking T1562.007 Disable or Modify Cloud Firewall T1562.008 Disable or Modify Cloud Logs T1562.009 Safe Mode Boot T1562.012 Disable or Modify Linux Audit System T1574.004 Dylib Hijacking T1574.005 Executable Installer File Permissions Weakness T1574.007 Path Interception by PATH Environment Variable T1574.008 Path Interception by Search Order Hijacking T1574.009 Path Interception by Unquoted Path T1574.010 Services File Permissions Weakness T1574.011 Services Registry Permissions Weakness T1574.012 COR_PROFILER T1574.014 AppDomainManager T1578.001 Create Snapshot T1578.002 Create Cloud Instance T1578.003 Delete Cloud Instance T1578.005 Modify Cloud Compute Configurations T1599.001 Network Address Translation Traversal T1601.001 Patch System Image T1601.002 Downgrade System Image
Credential Access
T1003 OS Credential Dumping T1110 Brute Force T1212 Exploitation for Credential Access T1528 Steal Application Access Token T1539 Steal Web Session Cookie T1552 Unsecured Credentials T1555 Credentials from Password Stores T1556 Modify Authentication Process T1558 Steal or Forge Kerberos Tickets T1606 Forge Web Credentials T1621 Multi-Factor Authentication Request Generation T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1003.004 LSA Secrets T1003.005 Cached Domain Credentials T1003.006 DCSync T1003.007 Proc Filesystem T1003.008 /etc/passwd and /etc/shadow T1056.003 Web Portal Capture T1110.001 Password Guessing T1110.002 Password Cracking T1110.003 Password Spraying T1110.004 Credential Stuffing T1552.001 Credentials In Files T1552.002 Credentials in Registry T1552.006 Group Policy Preferences T1552.007 Container API T1555.002 Securityd Memory T1555.006 Cloud Secrets Management Stores T1556.001 Domain Controller Authentication T1556.003 Pluggable Authentication Modules T1556.004 Network Device Authentication T1556.005 Reversible Encryption T1556.006 Multi-Factor Authentication T1556.007 Hybrid Identity T1556.008 Network Provider DLL T1556.009 Conditional Access Policies T1558.001 Golden Ticket T1558.002 Silver Ticket T1558.003 Kerberoasting T1558.005 Ccache Files T1606.001 Web Cookies T1606.002 SAML Tokens
Discovery
Lateral Movement
T1021 Remote Services T1072 Software Deployment Tools T1091 Replication Through Removable Media T1210 Exploitation of Remote Services T1550 Use Alternate Authentication Material T1563 Remote Service Session Hijacking T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.003 Distributed Component Object Model T1021.004 SSH T1021.005 VNC T1021.006 Windows Remote Management T1021.007 Cloud Services T1021.008 Direct Cloud VM Connections T1550.002 Pass the Hash T1550.003 Pass the Ticket T1563.001 SSH Hijacking T1563.002 RDP Hijacking
Collection
T1005 Data from Local System T1025 Data from Removable Media T1185 Browser Session Hijacking T1213 Data from Information Repositories T1530 Data from Cloud Storage T1056.003 Web Portal Capture T1213.001 Confluence T1213.002 Sharepoint T1213.003 Code Repositories T1213.004 Customer Relationship Management Software T1213.005 Messaging Applications
Exfiltration
T1041 Exfiltration Over C2 Channel T1048 Exfiltration Over Alternative Protocol T1052 Exfiltration Over Physical Medium T1537 Transfer Data to Cloud Account T1567 Exfiltration Over Web Service T1020.001 Traffic Duplication T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1052.001 Exfiltration over USB
Impact
T1485 Data Destruction T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1491 Defacement T1495 Firmware Corruption T1561 Disk Wipe T1657 Financial Theft T1485.001 Lifecycle-Triggered Deletion T1491.001 Internal Defacement T1491.002 External Defacement T1561.001 Disk Content Wipe T1561.002 Disk Structure Wipe
Compliance Mappings
ISO 27001:2022
A.5.15A.5.18A.8.2A.8.3A.8.18
ISO 27002:2022
5.155.188.28.38.18
COBIT 2019
DSS05DSS06
CIS Controls v8
CIS 3.3CIS 3.14CIS 5CIS 5.4CIS 6CIS 6.1CIS 6.8CIS 12.8
NIST CSF 2.0
PR.AA-05
SOC 2 TSC
CC6.1CC6.1-POF7
PCI DSS v4.0.1
3.47.17.28.6
CSA CCM v4
IAM-04IAM-05IAM-08IAM-09IAM-10IAM-11IAM-16LOG-04
CSA AICM v1
IAM-04IAM-05IAM-08IAM-09IAM-10IAM-11IAM-16IAM-18IAM-19LOG-04MDS-07
FINOS CCC
CCC-C11CCC-C12
ISO 42001:2023
A.3.2A.9.2
IEC 62443
3-3 SR 1.33-3 SR 2.1
NIS2 Directive
Art. 21(2)(i)
MAS TRM
9
APRA CPS 234
Para 22-23
ASD Essential Eight
E8-5E8-5 ML1E8-5 ML2E8-5 ML3E8-8 ML3
BSI IT-Grundschutz
OPS.1.1.2ORP.4
ANSSI
Hygiene.14Hygiene.15Hygiene.16Hygiene.17SecNumCloud.10.3SecNumCloud.10.4
FINMA Circular 2023/1
IV.B.d(59)IV.B.d(60)IV.C(61)
OSFI B-13
B-13.3.2
EU GDPR
Art.5(1)(c)Art.5(1)(f)Art.25(2)Art.32(1)(b)
EU DORA
Art.9(4)(c)Art.9(4)(d)
BIO2
5.155.188.28.38.18
RBI CSF
Annex1.8ITGRCA.19
FISC Security Guidelines
FISC.T2
LGPD + BCB 4893
BCB.Art.3LGPD.Art.6LGPD.Art.46
HKMA TM-E-1
TME1.8.1TME1.8.2
MLPS 2.0
8.1.4.28.1.5.18.1.10.4
DNB Good Practice
DNB.7.1DNB.17.2
EU CRA
CRA.I.2d
SWIFT CSCF
SWIFT.1.2SWIFT.5.1SWIFT.6.3
SAMA CSF
3.1
NCA ECC
2-2
UAE IA
T9
CBB TM
TM-6
Qatar NIA
AC
CBUAE
CR-4
CBE CSF
CD-1CTO-1
SA JS2
JS2-7.1
CBN CSF
Part3.2Part9
BoG CISD
CISD-VIII
POPIA
s10s19
BoM CTRM
3.3
IOSCO Cyber Resilience
PROT-1
BCBS 239
Principle 11
CPMI-IOSCO PFMI
CG.PRPFMI.P17
FFIEC IS
II.C.7II.C.7(b)II.C.13(a)II.C.15II.C.15(a)II.C.15(b)II.C.18
NYDFS 500
500.6500.7
HIPAA Security Rule
§164.308(a)(3)(i)§164.308(a)(3)(ii)(A)§164.308(a)(3)(ii)(B)§164.308(a)(4)(i)§164.308(a)(4)(ii)(B)§164.308(a)(4)(ii)(C)§164.312(a)(1)§164.314(b)(2)
ECB CROE
CROE.2.3.1
EBA ICT Guidelines
3.4.2
SEBI CSCRF
PR.AA
BOT Cyber Resilience
Ch2.2
CMMC 2.0
AC
10 CFR 73.54
RG5.71-A-AC
TSA Pipeline SD
SD-2 Sec B
IEEE 1686-2022
5.1
DOE C2M2 v2.1
ACCESS
API 1164
Sec 6
AWIA
AWWA Sec 3
IAEA NSS 17-T
Sec 5.3
FIPS 140-3
FIPS 140-3 §7.4
TIBER-EU
TIBER.CONF
PCI HSM
1458
Common Criteria
CC Part 2 — FDPCC Part 2 — FMT
ISAE 3402
Clause 4
Solvency II
EIOPA-ICT-4.4
Lloyd's Minimum Standards
MS1.1MS5.1MS8.3
NAIC Insurance Data Security
4-access4-audit4B
PRA SS1/23
P2.4P3.3P3.6P4.4P-IT.1
FCA SYSC 13
SYSC 13.6.2SYSC 13.7.3
HITRUST CSF v11
01.a13.c13.e
FDA 21 CFR Part 11
§11.10(d)§11.10(g)
FDA Cybersecurity Guidance
SA-1SA-4
ISO 27799
9.19.39.5H.4
NHS DSPT
NDG-1.1NDG-4.1NDG-4.4
OWASP MASVS v2.1
MASVS-PRIVACY-1
CCSS v9.0
1.03.51.04.31.05.11.05.3
MiCA
Art.36(1)Art.40(1)Art.55(1)Art.63(1)Art.65(1)Art.67(1)Art.86(1)Art.92(1)Art.97(1)
Basel SCO60
SCO60.55SCO60.61SCO60.62SCO60.64SCO60.66SCO60.72
BSSC Standards
GSP-11KMS-04KMS-05KMS-06KMS-09NOS-05NOS-08TIS-07
SEC Custody (Digital Assets)
SEC-CD-02SEC-CD-03SEC-CD-04SEC-CD-05SEC-CD-16
India DPDPA
Act.8(5)Rules.6(1)(b)Rules.Sch1.B.7
ISO 17799 (legacy)
11.2.2
COBIT 4.1 (legacy)
PO4.11