1Overview
AC.L2-3.1.6 is the practical companion to least privilege: it requires that people who hold privileged accounts use ordinary, non-privileged accounts for their ordinary, nonsecurity work. It closes the gap the previous control leaves open, because identifying and limiting privileged accounts accomplishes little if the administrator then spends the whole day logged in with those privileges to read email and browse the web.
The reasoning is direct. Privileged access carries the power to change systems and disable protections, and that power should be exposed only when it is actually being used. An administrator who reads email, opens attachments, and visits websites from a privileged session turns every routine risk of daily computing into a privileged-level risk, so that a single malicious attachment or compromised website can seize administrative control rather than merely a standard user's access. The control asks that privilege be set aside for the routine and picked up only for the work that requires it.
Use non-privileged accounts or roles when accessing nonsecurity functions.
The distinction is between nonsecurity functions, the everyday tasks that any user performs, email, documents, browsing, ordinary applications, and the security or administrative functions that require elevated rights. The control does not forbid privileged accounts; it requires that they not be used for work that does not need them. In practice this means administrators hold two accounts, a standard account for daily use and a separate privileged account used only when elevation is genuinely required.
2The Assessment Objectives
NIST SP 800-171A decomposes 3.1.6 into two objectives: identify which functions are nonsecurity functions, and require non-privileged accounts when performing them.
Nonsecurity functions are identified. The organization has distinguished the everyday tasks that do not require privilege from the administrative and security tasks that do.
Users are required to use non-privileged accounts or roles when accessing nonsecurity functions. The requirement is enforced or enforced by policy and practice, so administrators use their standard accounts for everyday work.
The two objectives are simple to state and their satisfaction turns almost entirely on one habit: whether the people who hold privileged accounts also carry and use ordinary accounts for ordinary work. Objective [a] is a short definition, and objective [b] is the practice that the definition requires.
3Failure Patterns
The failures are variations on a single theme: privilege used where it was not needed, usually because carrying two accounts feels like friction.
The single all-purpose administrator account
The most common failure, and the one this control exists to end. An administrator has one account, and it is privileged, so every email, download, and website is opened with administrative rights. The remedy is to issue that person a second, standard account for daily use and reserve the privileged account for administration, which is straightforward to set up and takes discipline to sustain.
Two accounts, but the privileged one is used anyway
Some shops create the standard and privileged accounts correctly, then undermine the control by habit: the administrator logs in with the privileged account each morning because it can do everything, and the standard account sits unused. Objective [b] is about practice, not provisioning, and the assessor can see which account is actually in daily use from the logs.
Elevated service or shared accounts used interactively
A powerful shared or service account used for interactive daily tasks carries the same problem in a form that is harder to attribute, because the privileged activity cannot even be tied to an individual. Routine work performed through such an account fails the control and complicates the audit trail at the same time.
4Ownership
This control is owned by IT and is largely about the working habits of the technical staff themselves, which makes it one of the few controls where the owner and the subject are the same people. Leadership support matters mainly in setting the expectation that the inconvenience is accepted.
| Role | Responsibility for this control |
|---|---|
| IT lead or system administrator | Establishes the two-account model for every privileged user, uses the standard account for daily work, and reserves the privileged account for administration. The primary subject of the control as well as its implementer. |
| Security or compliance lead | Defines which functions are nonsecurity functions and confirms the two-account practice is followed rather than merely provisioned. |
| Program lead | Includes the practice in periodic review, checking that privileged accounts are not the accounts in daily interactive use, and retains the record. |
| Executive sponsor | Sets the expectation that administrators accept the minor friction of two accounts, since the control depends on a habit that is easy to abandon under time pressure. |
5Tooling
The tooling is minimal, because the control is a practice more than a technology. The work is provisioning second accounts and creating the conditions that make using them natural.
| Objectives | Tooling | What it provides |
|---|---|---|
| [a] | A brief statement in the access policy or SSP | The written identification of nonsecurity functions and the requirement to perform them with standard accounts. |
| [b] | Separate standard and privileged accounts in Active Directory or Entra ID | Each administrator receives a standard daily account and a distinct privileged account, so nonsecurity work is performed without elevation. |
| [b] reinforcement | User Account Control, run-as elevation, privileged access management where available | Prompting for elevation only when a privileged action is taken keeps the standard account in daily use and surfaces privilege only when needed. Just-in-time elevation, where the environment supports it, strengthens the same practice. |
| Verification | Sign-in logs, privileged-account activity review | Reviewing which account each administrator actually uses for daily sign-in confirms the practice is real, since the control is satisfied by behavior rather than by the existence of a second account. |
The caveat here is unusually plain: the technology is trivial and the discipline is everything. Provisioning a second account takes minutes, and the control is satisfied or failed by whether the privileged user actually uses the standard account for ordinary work day after day. The assessor confirms objective [b] by examining which account appears in routine interactive sign-ins, not by confirming that a second account exists.
6Evidence
The satisfied version of 3.1.6 shows the two-account model in place and, more importantly, in use.
| Evidence | What it demonstrates |
|---|---|
| Policy identifying nonsecurity functions | Objective [a]. The written distinction between everyday work and administrative functions, and the requirement to use standard accounts for the former. |
| Dual-account provisioning records | Objective [b]. Evidence that privileged users hold both a standard and a separate privileged account. |
| Sign-in and account usage logs | Objective [b]. Records showing the standard account is the one used for daily interactive work, and the privileged account appears only for administrative tasks. |
| Elevation configuration | Objective [b]. User Account Control or equivalent settings that require deliberate elevation for privileged actions. |
The evidence for this control leans on the usage logs more than on provisioning, because the assessor is checking a behavior. A pair of accounts with the privileged one in constant daily use fails the control as surely as having no second account at all. The practice, once established, is nearly free to maintain and quietly strengthens the whole privileged tier, since it keeps administrative power out of the path of ordinary daily risk.
The habit is the hard part, not the setup
Standing up two-account administration takes an afternoon; getting technical staff to live inside the standard account and reach for privilege only when needed takes a bit of coaching and a clear expectation from the top. Helping a team establish that habit, and the elevation practices that make it natural, is part of the onsite readiness work this practice does.
Start CMMC Readiness or call 802-335-26627Sources
- NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.1.6. csrc.nist.gov
- NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objectives 3.1.6[a] and 3.1.6[b]. csrc.nist.gov
- 32 CFR 170.21, Plan of Action and Milestones Requirements, governing which requirements may remain open at a Level 2 assessment. ecfr.gov