AC-6: Least privilege is enforced for users, processes, and security functions

What AC-6 requires

Least privilege is enforced for users, processes, and security functions.

Paraphrased from NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems and Organizations (checked 2026-10-31). scm.cc does not reproduce the official control text; read the NIST catalog for the normative wording.

FedRAMP 20x KSIs that cover AC-6

These Key Security Indicators officially cite AC-6 as a related SP 800-53 control, so satisfying them is how a 20x package demonstrates this control.

• KSI-IAM-AAM — Automating Account Management

  Identity and Access Management · official related-control citation: ac-6.7

• KSI-IAM-ELP — Ensuring Least Privilege

  Identity and Access Management · official related-control citation: ac-6, ac-6.3, ac-6.8

• KSI-IAM-JIT — Authorizing Just-in-Time

  Identity and Access Management · official related-control citation: ac-6, ac-6.1, ac-6.10, ac-6.2, ac-6.3, ac-6.5, ac-6.7, ac-6.8, ac-6.9

• KSI-IAM-SNU — Securing Non-User Authentication

  Identity and Access Management · official related-control citation: ac-6.5

• KSI-MLA-LET — Logging Event Types

  Monitoring, Logging, and Auditing · official related-control citation: ac-6.9

• KSI-MLA-RVL — Reviewing Logs

  Monitoring, Logging, and Auditing · official related-control citation: ac-6.9

• KSI-SVC-ACM — Automating Configuration Management

  Service Configuration · official related-control citation: ac-6.8

Evidence scm.cc collects for AC-6

scm.cc tracks this as manual evidence you attach; it validates and replays exactly what you provide (no automated claim beyond that).

Check your readiness · KSI ↔ NIST crosswalk explorer

Related Access Control controls

• AC-17 — Remote access is authorized, encrypted, and monitored
• AC-2 — Accounts are provisioned, reviewed, and de-provisioned through a managed lifecycle