Mapped Requirement and Assessment Objective
Mapped to NIST 800-171 requirement 3.1.5 and CMMC Level 2 assessment objective AC.L2-3.1.5[a].
What This Objective Means
This objective requires organizations to define and document system roles to support the principle of least privilege.
Each role must be clearly described and aligned with specific job functions so users receive only the access necessary to perform assigned responsibilities.
Why Role Definitions Matter
Without clearly documented roles, access may be granted inconsistently, excessive permissions may accumulate, and least privilege becomes difficult to enforce.
Well-defined roles support consistent access provisioning, periodic access reviews, and audit-ready justification under least privilege access control requirements.
How to Implement AC 3.1.5a
Create a documented role catalog or role matrix that defines each role, its responsibilities, and the level of system access required.
Roles should include both technical and non-technical users who interact with systems handling sensitive data, and be referenced in policies, procedures, and the System Security Plan (SSP) as part of a broader CMMC Level 2 compliance framework.
Role Definition Summary
| Role | Description | Access Scope |
|---|---|---|
| Standard User | Performs routine job functions requiring limited system access. | Access limited to assigned applications and data necessary for duties. |
| System Administrator | Responsible for managing and maintaining system configurations. | Elevated privileges restricted to administrative functions. |
| Security or Compliance Role | Monitors security controls and compliance activities. | Read-only or scoped access to logs, configurations, and reports. |
| Privileged Support Role | Provides temporary or specialized support functions. | Time-bound or task-specific elevated access. |
Evidence Assessors Commonly Expect
Assessors commonly expect a documented role catalog or matrix, descriptions linking roles to access permissions, and references to roles within the SSP and access control procedures.
They may also verify that access provisioning decisions are based on documented roles rather than informal assignments.
Common Gaps to Avoid
Common gaps include undocumented roles, roles defined only in HR systems without technical mapping, overlapping roles without clear scope, and excessive privileges assigned by default.
FAQ
What is required by AC.L2-3.1.5[a]?
Organizations must define and document system roles and what each role is allowed to access or perform.
Do roles have to be highly granular?
No. Roles should be detailed enough to support least privilege but practical for consistent use and enforcement.
What evidence supports compliance with this objective?
Evidence includes a role catalog or matrix, role-to-access mappings, and SSP or policy references showing role-based access decisions.