Transaction & Function Control

Objective [a] is a document you write, not a setting.

List the user types in your system, such as standard user, administrator, and finance, and the transactions and functions each may execute. Create, read, update, and delete per system or application is the level of granularity the assessment guide uses. A one-page matrix satisfies [a].

Objective [b] is the enforcement of that matrix.

Show the roles and groups that implement it: Microsoft 365 role assignments, file share permissions, application roles, or an application control tool. Present the configuration next to the matrix so the assessor can see that what is defined is what is enforced.

You do not need a directory service to meet this.

A four-person shop can use local Windows standard versus administrator accounts and application allowlisting, which blocks unapproved programs. Confine CUI, the controlled unclassified information your contract requires you to protect, to specific application accounts. Define the split and enforce it with what you have. An answer scaled to your size is enough.

Personal use is yours to define, not yours to ban.

Nothing in the requirement forbids web mail or music streaming on a NIST SP 800-171 system. What it requires is that you define the limits and keep personal applications and accounts away from CUI and official duties. A wide personal-use allowance creates work elsewhere, in CM.L2-3.4.7 for least functionality and AC.L2-3.1.20 for external connections. The more personal use you allow, the more you have to control elsewhere.

AC.L2-3.1.1 covers who gets access. This requirement covers what they can do once they have it.

Keep the two answers distinct in your system security plan. Account authorization and inventories live under AC.L2-3.1.1. This requirement is where you show that a proposal writer cannot reach developer tools and a developer cannot reach the HR database.