administrative privilege
163506·updated Aug 30, 2026A class of access rights — elevated above those granted to standard users — that collectively authorize an account or identity to perform security-sensitive operations that affect the configuration, integrity, or management of a system or network. What distinguishes it from ordinary user permissions is the authority to modify or override other accounts' rights and to perform security-relevant functions — such as key management, account management, network and system administration, and database administration — that ordinary users are not authorized to perform. In practice, the field uses the term to identify a condition that triggers heightened governance: users or accounts requiring administrative privileges on system accounts receive additional scrutiny from organizational personnel — such as the system owner, mission/business owner, or chief information security officer — responsible for approving such accounts and privileged access. Control frameworks invoke it primarily to enforce least-privilege goals: limiting how many accounts carry such privileges reduces the probability of a threat actor abusing them to cause harm.
Source
types include individual, group, temporary, system, guest, anonymous, emergency, developer, and service. Users who require administrative privileges onthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- Best Practices for Privileged User PIV Authentication | NIST
- Election Security Spotlight – Principle of Least Privilege
- AC-2 - NIST 800-53 r5 Control Explorer - GRC Academy
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A level of access permission granted to an account that authorizes the holder to perform control, configuration, and administration functions on a system — such as installing software, modifying security settings, managing other accounts, or altering system behavior — that are withheld from standard users. Users who require administrative privileges on system accounts receive additional scrutiny by personnel responsible for approving such accounts and privileged access. Because IT personnel with administrative privileges can affect the security posture of an entire system, the field treats the expression as an authorization category subject to least-privilege controls, heightened authentication requirements, and continuous monitoring; administrative privileges are often required for malware to execute, making their governance a primary attack-surface concern. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- administrative privileges
- possessive
- administrative privilege's
- pluralpossessive
- administrative privileges'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A class of access rights — elevated above those granted to standard users — that collectively authorize an account or identity to perform security-sensitive operations that affect the configuration, integrity, or management of a system or network. What distinguishes it from ordinary user permissions is the authority to modify or override other accounts' rights and to perform security-relevant functions — such as key management, account management, network and system administration, and database administration — that ordinary users are not authorized to perform. In practice, the field uses the term to identify a condition that triggers heightened governance: users or accounts requiring administrative privileges on system accounts receive additional scrutiny from organizational personnel — such as the system owner, mission/business owner, or chief information security officer — responsible for approving such accounts and privileged access. Control frameworks invoke it primarily to enforce least-privilege goals: limiting how many accounts carry such privileges reduces the probability of a threat actor abusing them to cause harm.DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A level of access permission granted to an account that authorizes the holder to perform control, configuration, and administration functions on a system — such as installing software, modifying security settings, managing other accounts, or altering system behavior — that are withheld from standard users. Users who require administrative privileges on system accounts receive additional scrutiny by personnel responsible for approving such accounts and privileged access. Because IT personnel with administrative privileges can affect the security posture of an entire system, the field treats the expression as an authorization category subject to least-privilege controls, heightened authentication requirements, and continuous monitoring; administrative privileges are often required for malware to execute, making their governance a primary attack-surface concern. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.