non-privileged account
A managed access credential (user account or role) whose authorization scope is restricted to ordinary, non-administrative tasks — that is, it carries only the permissions required for routine work and is explicitly excluded from security functions such as administering accounts, modifying audit configurations, managing cryptographic keys, or changing access authorizations. Standards such as NIST SP 800-53 AC-6(2) require users who also hold privileged accounts to switch to non-privileged accounts when performing nonsecurity functions, because operating continuously from a privileged account needlessly expands the attack surface. The concept extends to roles under role-based access control, where a change of role can provide the same boundary as a change between a privileged and non-privileged account. In practice, controls across NIST SP 800-53, SP 800-171, and CMMC all use the term as the complement of "privileged account" to enforce least privilege: users must use non-privileged accounts or roles when accessing nonsecurity functions, and are prevented from executing privileged functions from those accounts.
Senses
No definition is given in NIST SP 800-171r3. The term is attested in use at 4 citations in that document; a definition is pending curation.
A managed user or system account credential whose permissions are explicitly bounded to ordinary, non-administrative tasks — it cannot invoke security functions, modify system configuration, or access restricted data without a separate elevation step. As defined by NIST SP 800-53 (AC-6(2)) and NIST SP 800-171 (3.1.6), privileged accounts are granted elevated privileges to access resources — including security functions or security-relevant information — that are otherwise restricted for non-privileged accounts; a non-privileged account is therefore the contrasting account type that operates below that threshold. The field uses the term to enforce the principle of least privilege through dual-account practice: privileged users are required to use separate non-privileged accounts for routine tasks unrelated to system or security administration, and general computing activities — such as internet browsing, email, and productivity suite use — are conducted from the user's primary, non-privileged account (CIS Controls). The term encompasses any account type that sits below the privileged threshold — standard user accounts and guest accounts are considered non-privileged, since they are given limited access to systems and data — and applies equally to role-based constructs: the inclusion of roles addresses situations where a change of role provides the same degree of assurance in the change of access authorizations as would be provided by a change between a privileged and non-privileged account.
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- non-privileged accounts
- possessive
- non-privileged account's
- pluralpossessive
- non-privileged accounts'