elevated privilege
163582·updated Sep 1, 2026A level of access rights assigned to an account, process, or identity that exceeds standard user permissions — authorizing operations on security functions, restricted data, or system configuration that ordinary accounts cannot perform. As NIST SP 800-171r3 frames it, "privileged accounts refer to accounts that are granted elevated privileges to access resources (including security functions or security-relevant information) that are otherwise restricted for non-privileged accounts." The distinguishing characteristic is not a specific role or account type but the *degree* of permission relative to a baseline: a privileged network account with elevated privileges is "typically allocated to system administrators, network administrators, DBAs, and others who are responsible for system/application control, monitoring, or administration functions" — but the expression covers any identity (human, service, or process) whose rights cross that threshold. NIST also applies the concept to software, noting that critical software "is designed to run with elevated privilege or manage privileges" or "has direct or privileged access to networking or computing resources." In practice, the field use
Source
refer to accounts that are granted elevated privileges to access resources (includingthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- NIST Special Publication 800 NIST SP 800-171r3
- privileged network account - Glossary | CSRC
- AC-6(8): Privilege Levels for Code Execution - CSF Tools
- Cyber-attack TTP analysis for EPES systems
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A level of access permission — assigned to an account, process, or identity — that exceeds the baseline rights granted to ordinary users, authorizing operations (such as modifying system configuration, accessing restricted resources, or executing security-critical functions) that are withheld from standard accounts. Privileged accounts are those "granted elevated privileges to access resources (including security functions or security-relevant information) that are otherwise restricted for non-privileged accounts," per NIST SP 800-171r3; at the network level, NIST SP 800-50r1 defines this as a condition typically allocated to system administrators, network administrators, DBAs, and others responsible for system/application control, monitoring, or administration. The field uses the expression both as a property of legitimately authorized accounts and as a target state in adversarial contexts: software applications or processes may need to execute with elevated privileges to perform required functions, but this can indirectly provide users with greater privileges than those formally assigned to them; conversely, elevated privileges are important to bypass safety mechanisms of industrial controllers, and can also be used to bypass access controls or security mechanisms more broadly.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- elevated privileges
- possessive
- elevated privilege's
- pluralpossessive
- elevated privileges'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A level of access rights assigned to an account, process, or identity that exceeds standard user permissions — authorizing operations on security functions, restricted data, or system configuration that ordinary accounts cannot perform. As NIST SP 800-171r3 frames it, "privileged accounts refer to accounts that are granted elevated privileges to access resources (including security functions or security-relevant information) that are otherwise restricted for non-privileged accounts." The distinguishing characteristic is not a specific role or account type but the *degree* of permission relative to a baseline: a privileged network account with elevated privileges is "typically allocated to system administrators, network administrators, DBAs, and others who are responsible for system/application control, monitoring, or administration functions" — but the expression covers any identity (human, service, or process) whose rights cross that threshold. NIST also applies the concept to software, noting that critical software "is designed to run with elevated privilege or manage privileges" or "has direct or privileged access to networking or computing resources." In practice, the field useDR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A level of access permission — assigned to an account, process, or identity — that exceeds the baseline rights granted to ordinary users, authorizing operations (such as modifying system configuration, accessing restricted resources, or executing security-critical functions) that are withheld from standard accounts. Privileged accounts are those "granted elevated privileges to access resources (including security functions or security-relevant information) that are otherwise restricted for non-privileged accounts," per NIST SP 800-171r3; at the network level, NIST SP 800-50r1 defines this as a condition typically allocated to system administrators, network administrators, DBAs, and others responsible for system/application control, monitoring, or administration. The field uses the expression both as a property of legitimately authorized accounts and as a target state in adversarial contexts: software applications or processes may need to execute with elevated privileges to perform required functions, but this can indirectly provide users with greater privileges than those formally assigned to them; conversely, elevated privileges are important to bypass safety mechanisms of industrial controllers, and can also be used to bypass access controls or security mechanisms more broadly.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.