AC.L2-3.1.5[a]: Define and Document System Roles to Support Least Privilege

Mapped Requirement and Assessment Objective

Mapped to NIST 800-171 requirement 3.1.5 and CMMC Level 2 assessment objective AC.L2-3.1.5[a].

What This Objective Means

This objective requires organizations to define and document system roles to support the principle of least privilege.

Each role must be clearly described and aligned with specific job functions so users receive only the access necessary to perform assigned responsibilities.

Why Role Definitions Matter

Without clearly documented roles, access may be granted inconsistently, excessive permissions may accumulate, and least privilege becomes difficult to enforce.

Well-defined roles support consistent access provisioning, periodic access reviews, and audit-ready justification under least privilege access control requirements.

How to Implement AC 3.1.5a

Create a documented role catalog or role matrix that defines each role, its responsibilities, and the level of system access required.

Roles should include both technical and non-technical users who interact with systems handling sensitive data, and be referenced in policies, procedures, and the System Security Plan (SSP) as part of a broader CMMC Level 2 compliance framework.

Role Definition Summary

Role Description Access Scope
Standard User Performs routine job functions requiring limited system access. Access limited to assigned applications and data necessary for duties.
System Administrator Responsible for managing and maintaining system configurations. Elevated privileges restricted to administrative functions.
Security or Compliance Role Monitors security controls and compliance activities. Read-only or scoped access to logs, configurations, and reports.
Privileged Support Role Provides temporary or specialized support functions. Time-bound or task-specific elevated access.

Evidence Assessors Commonly Expect

Assessors commonly expect a documented role catalog or matrix, descriptions linking roles to access permissions, and references to roles within the SSP and access control procedures.

They may also verify that access provisioning decisions are based on documented roles rather than informal assignments.

Common Gaps to Avoid

Common gaps include undocumented roles, roles defined only in HR systems without technical mapping, overlapping roles without clear scope, and excessive privileges assigned by default.

FAQ

What is required by AC.L2-3.1.5[a]?

Organizations must define and document system roles and what each role is allowed to access or perform.

Do roles have to be highly granular?

No. Roles should be detailed enough to support least privilege but practical for consistent use and enforcement.

What evidence supports compliance with this objective?

Evidence includes a role catalog or matrix, role-to-access mappings, and SSP or policy references showing role-based access decisions.

🍪 We Use Cookies

To enhance your experience and analyze site usage, we use cookies. By continuing to use our site, you agree to our use of cookies in accordance with our Privacy Policy.