AC-6(7)

Requirement
1. Review [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges; and
2. Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.

Discussion

The need for certain assigned user privileges may change over time to reflect changes in organizational mission and business functions, environments of operation, technologies, or threats. A periodic review of assigned user privileges is necessary to determine if the rationale for assigning such privileges remains valid. If the need cannot be revalidated, organizations take appropriate corrective actions.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; procedures addressing least privilege; list of system-generated roles or classes of users and assigned privileges; system design documentation; system configuration settings and associated documentation; validation reviews of privileges assigned to roles or classes or users; records of privilege removals or reassignments for roles or classes of users; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks; organizational personnel with information security responsibilities; system/network administrators].

ID	Assessment Objectives
AC-06(07)(a)	privileges assigned to <AC-06(07)_ODP[02] roles and classes> are reviewed <AC-06(07)_ODP[01] frequency> to validate the need for such privileges;
AC-06(07)(b)	privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!