Least Privilege AC-6

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-6 (Least Privilege) means granting each user, process, and service only the access it needs to do its job and nothing more. At Moderate it adds enhancements: separate privileged accounts, limit them to named people (AC-6(5)), and log the use of privileged functions (AC-6(9)).

What good looks like

• Assign the minimum privileges required for each role or service.
• Separate privileged from non-privileged accounts, and use the non-privileged one for routine work.
• Restrict privileged accounts to a defined, named set of personnel (AC-6(5)).
• Log the execution of privileged functions so use of elevated rights is auditable (AC-6(9)).

Framework mapping

• NIST CSF 2.0 — PR.AA-05 — Access is managed with least privilege and separation of duties
• CIS Controls v8 — Control 6.8 — Grant access rights via role-based, least-privilege assignment

How to move it toward Implemented

• Partially met on VM 607: a named BLUEADMIN elevates through the sudo group instead of a shared root login, root login is disabled (§1a, §1c), auditd records every command run as root via -F euid=0 execve (AC-6(9), §2a), and a login-account inventory (grep -vE '/nologin|/false' /etc/passwd, §4b) confirms only BLUEADMIN has interactive login (AC-6(5)).
• Close the gap by narrowing sudoers from blanket sudo to specific commands (a scoped Cmnd_Alias allow-list) so the admin cannot run arbitrary root commands.
• The PlumbWatch monitor runs as root because packet capture needs it (§3c) - document this as an accepted least-privilege exception, or drop it to a scoped capability such as CAP_NET_RAW.
• Produce a formal privileged-account inventory, then attach the review plus the sudoers scoping as evidence naming AC-6 to move from partial toward 'Completed'.