Least Privilege - Privileged Functions is the third piece of the least privilege family, and it is about the actions rather than the accounts. Least Privilege (03.01.05) sets the general principle, Least Privilege - Privileged Accounts (03.01.06) governs who may hold an elevated account, and Least Privilege - Privileged Functions (03.01.07) governs the privileged functions themselves. It does two things: it prevents non-privileged users from executing privileged functions, and it logs the execution of privileged functions. Per the NIST discussion, this requirement represents a condition achieved by the definition of authorized privileges in 03.01.01 and privilege enforcement in 03.01.02, so it sits on top of your account management and access enforcement work rather than replacing it. Privileged functions include establishing system accounts, performing system integrity checks, conducting patching operations, changing system configuration settings, and administering cryptographic key management activities.
A common difficulty with this requirement is treating it as the same thing as restricting privileged accounts and forgetting the logging half. Part a (prevent non-privileged users from executing privileged functions) usually falls out of a correct access model. Part b (log the execution of privileged functions) is a separate, explicit obligation that an assessor will check on its own. If your privileged actions are not being logged, you fail part b even if your access restrictions are perfect.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.01.07 Least Privilege - Privileged Functions. Only the formatting has been adjusted for readability. This requirement has two (2) lettered parts:
The source controls are AC-06(09) and AC-06(10) from NIST 800-53. There are no Organization-Defined Parameters (ODPs) in this requirement. The NIST discussion names the functions in scope: establishing system accounts, performing system integrity checks, conducting patching operations, changing system configuration settings, and administering cryptographic key management activities. It also calls out that bypassing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users, and that logging the use of privileged functions helps detect misuse from both insider threats and compromised accounts. You can read the requirement directly at NIST 800-171 R3, 03.01.07 (p. 11).
None (0). Requirement 03.01.07 contains no bracketed assignment, so there is no organization-defined value to select and nothing for the DoD to specify. The requirement applies as written.
Your System Security Plan (SSP) narrative for 03.01.07 therefore records how the requirement is implemented rather than a parameter you chose.
NIST 800-171A R3 breaks 03.01.07 into two (2) determination statements, and it has no Organization-Defined Parameters (ODPs). These AOs are:
The two (2) AOs are the two halves of the requirement: prevention (A.03.01.07.a) and logging (A.03.01.07.b). They carry separate evidence, and demonstrating that non-privileged users cannot execute privileged functions does not demonstrate that privileged-function execution is logged. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.01.07 (p. 13).
Examine: access control policy and procedures; procedures for least privilege; system design documentation; system configuration settings; system audit records; list of audited events; list of privileged functions to be audited and associated user account assignments; system security plan.
Interview: personnel with responsibilities for reviewing least privileges; personnel with information security responsibilities; system developers; system administrators.
Test: mechanisms for auditing the execution of least privilege functions; mechanisms for implementing least privilege functions for non-privileged users.
03.01.07 maps from NIST 800-171 R2 requirement 3.1.7 (prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs):
Mapped against the two (2) AOs, both (2) are direct (minimal effort), with no net-new AOs and none with no mapping. This is one of the cleaner transitions in the family, but the count hides a dropped dependency. R2 3.1.7 also had two "define" objectives that R3 removed as assessable items: 3.1.7[a] (privileged functions are defined) and 3.1.7[b] (non-privileged users are defined). As ComplianceForge's NIST 800-171 R3 Transition Guide notes in its "Logical Access Control / Account Management" analysis, R3 assumes privileged functions and non-privileged users are already identified even though no R3 AO explicitly requires you to document it. The enforcement work carries forward cleanly, but the identification work is now an assumed prerequisite rather than a checked objective.
Source Controls in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.01.07 through the following SCF controls:
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
The following are issues teams may encounter rather than certainties. They are about the logging obligation and the dropped definitions, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.01.07 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.01.07 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
Alongside these, keep the System Security Plan (SSP) narrative for 03.01.07.
With both AOs mapping directly and none net new, 03.01.07 is a lighter lift, but the logging half and the assumed definitions are where the work hides. A realistic sequence:
How many assessment objectives does NIST 800-171 R3 03.01.07 have? NIST 800-171A R3 breaks 03.01.07 into two (2) assessment objectives. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 controls does NIST 800-171 R3 03.01.07 come from? AC-06(09), AC-06(10).
How many Organization-Defined Parameters (ODPs) does NIST 800-171 R3 03.01.07 have? None (0). The requirement contains no bracketed assignment, so there is no organization-defined value and nothing for the DoD to specify.
Where does NIST 800-171 R3 03.01.07 sit in the NIST 800-171 R3 Kill Chain? Phase 13, Identity & Access Management (IAM). The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
03.01.07 Least Privilege - Privileged Functions prevents non-privileged users from executing privileged functions and requires that privileged-function execution is logged. It maps cleanly from R2 3.1.7 with both assessment objectives transitioning directly, so there is no net-new work in the objectives themselves. The traps are forgetting that logging is a separate obligation and assuming the dropped "define the functions and users" work is gone when R3 still depends on it. Confirm your definitions, enforce the prevention through 03.01.01 and 03.01.02, then prove you log privileged-function execution.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
