AC-06: Least Privilege

[kniz-raft]

AC:

• Control implementation statement has been reviewed by Raft for technical accuracy
• Control implementation statement has passed QASP review

DoD:

• Control implementation statement has been documented in GitHub

Control Description:
The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

AC-6 (2) Additional FedRAMP Requirements and Guidance: Examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions.

[rnafarrete]

Created pull request for AC-06

[rnafarrete]

Updated based on comments.