CMMC Practice AC.3.018

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Source

CMMC Version 1.02, pg. 68

Bold Coast Security Guidance

There are a couple of things going on here: first, you can't give everyone in your organization administrative rights. This includes removing these rights at the workstation level. Many organizations have allowed users to retain what is referred to as "local administrative privileges" at the workstation level to reduce overhead on the IT Staff for installing software and approving changes. That is not a good cyber-security practice as it also allows malicious software to be easily installed and take control of the workstations. It allows the installation of unapproved software making tracking of approved software harder on IT. Second, you must employ a system which captures audit logs, detects the use of administrative functions, and sends an alert or provides regular reports for review when this has happened.

Discussion From Source

DRAFT NIST SP 800-171 R2 Privileged functions include establishing system accounts, performing system integrity checks, conducting patching operations, or administering cryptographic key management activities. Non -privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. Note that this requirement represents a condition to be achieved by the definition of authorized privileges in 3.1.2 (AC.1.002). Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Logging the use of privileged functions is one way to detect such misuse, and in doing so, help mitigate the risk from insider threats and the advanced persistent threat.

References