Skip to content
ControlVerdict
Sign in
AC.L2-3.1.7CMMC Level 2Level 2

Privileged Functions

Submit your own example

Practice statement

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.1.7.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(4)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    privileged functions are defined;

    1 example covers this

  2. [b]

    non-privileged users are defined;

    1 example covers this

  3. [c]

    non-privileged users are prevented from executing privileged functions; and

    1 example covers this

  4. [d]

    the execution of privileged functions is captured in audit logs.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    AC.L2-3.1.7Privileged Functions
    Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

    • [a]

      privileged functions are defined;

    • [b]

      non-privileged users are defined;

    • [c]

      non-privileged users are prevented from executing privileged functions; and

    • [d]

      the execution of privileged functions is captured in audit logs.

    Block privileged functions for standard users; log every elevation

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses all Privileged Functions objectives (prevent + capture).

    Prevent. Standard users cannot activate Global Admin, User Admin, or enclave storage admin roles. Those roles are PIM-eligible. Endpoint local admin is denied by policy; UAC alone is not the control.

    Capture. PIM activations (who, why/ticket, MFA method, duration) stream to the SIEM. Falcon records process creations under elevated tokens on PAWs. Alerts fire on elevation outside change windows.

    Maintenance. Weekly review of PIM activations without ticket IDs. Quarterly tabletop of a suspected privilege abuse using SIEM queries.

    Accepted gap. One vendor appliance has a shared root equivalent with no federation. Console access is PAW-only; commands are session-recorded; password dual-custody.

    What the evidence looks like

    • PIM role settings showing eligible-not-active for privileged roles
    • SIEM query results for a sample week of activations
    • Falcon / endpoint policy denying local admin to standard users
    • Appliance session-recording sample

    Environment

    Cloud-forward OSC; Entra ID + PIM; CrowdStrike for endpoint telemetry.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.