AC-6.9: Log Use of Privileged Functions

Access control policy

procedures addressing least privilege

system design documentation

system configuration settings and associated documentation

list of privileged functions to be audited

list of audited events

system audit records

system security plan

other relevant documents or records

Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks

organizational personnel with information security responsibilities

system/network administrators

system developers

Mechanisms auditing the execution of least privilege functions