Non-Privileged Account Use

Official Source Material

Use non-privileged accounts or roles when accessing nonsecurity functions.

Determine if:

[a] nonsecurity functions are identified; and
[b] users are required to use non-privileged accounts or roles when accessing nonsecurity functions.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

This requirement is policy and habit, built on the account separation from AC.L2-3.1.5.

AC.L2-3.1.7 technically blocks non-privileged users from privileged functions. This requirement points the other way: privileged people must use their non-privileged account for ordinary work. The implementation is a written rule, training that reinforces it, and the two-account pattern that makes following it possible.

Define nonsecurity functions as everything that is not a security function.

Objective [a] does not demand a second inventory. Identify your security functions under AC.L2-3.1.5, then state that all other functions are nonsecurity functions and must be accessed with non-privileged accounts or roles. Assessors accept that definition, and it stays correct as your systems change.

The rule in one sentence: do not read email or browse the web from a privileged session.

Put that sentence in the rules for administrators, train on it, and keep the acknowledgment. A compromised browser tab in an administrative context is the exact exposure this requirement exists to prevent, and it is the first thing an assessor asks administrators about in interviews.

Elevation models count as roles.

sudo on Linux and Privileged Identity Management in Microsoft Entra ID both fit the requirement: the user operates without privilege until a scoped, temporary elevation, then drops back. What fails is standing elevation, an account that carries administrator rights all day while being used for daily work.

What falls short

A daily-use account that holds permanent administrator rights. The user is never on a non-privileged account, so [b] cannot be met no matter what the policy says.
An unwritten understanding that administrators know better than to browse from admin accounts. Without a documented requirement and training there is no evidence for [b].

Edge cases

Users in the sudo group are using a non-privileged role until the moment they elevate, so sudo satisfies the requirement as long as people are not running everything as root. Tighten the sudoers file to the commands each role needs.
Developers who need local admin can be kept out of the privileged population by definition, provided their local admin rights cannot touch security functions. Write that definition deliberately and be ready to defend it.