non-privileged account
163579·updated Sep 1, 2026A managed access credential (user account or role) whose authorization scope is restricted to ordinary, non-administrative tasks — that is, it carries only the permissions required for routine work and is explicitly excluded from security functions such as administering accounts, modifying audit configurations, managing cryptographic keys, or changing access authorizations. Standards such as NIST SP 800-53 AC-6(2) require users who also hold privileged accounts to switch to non-privileged accounts when performing nonsecurity functions, because operating continuously from a privileged account needlessly expands the attack surface. The concept extends to roles under role-based access control, where a change of role can provide the same boundary as a change between a privileged and non-privileged account. In practice, controls across NIST SP 800-53, SP 800-171, and CMMC all use the term as the complement of "privileged account" to enforce least privilege: users must use non-privileged accounts or roles when accessing nonsecurity functions, and are prevented from executing privileged functions from those accounts.
Source
use non-the sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- 03.01.06: Least Privilege — Privileged Accounts - CSF Tools
- NIST SP 800-53 AC-6(2): Non-Privileged Access for Nonsecurity Functions Explained - Anchor Defense
- CIS Controls Navigator v8.1
- What is a Privileged Account? - Keeper Security
- AC-6(2): Non-Privileged Access For Nonsecurity Functions - CSF Tools
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A managed user or system account credential whose permissions are explicitly bounded to ordinary, non-administrative tasks — it cannot invoke security functions, modify system configuration, or access restricted data without a separate elevation step. As defined by NIST SP 800-53 (AC-6(2)) and NIST SP 800-171 (3.1.6), privileged accounts are granted elevated privileges to access resources — including security functions or security-relevant information — that are otherwise restricted for non-privileged accounts; a non-privileged account is therefore the contrasting account type that operates below that threshold. The field uses the term to enforce the principle of least privilege through dual-account practice: privileged users are required to use separate non-privileged accounts for routine tasks unrelated to system or security administration, and general computing activities — such as internet browsing, email, and productivity suite use — are conducted from the user's primary, non-privileged account (CIS Controls). The term encompasses any account type that sits below the privileged threshold — standard user accounts and guest accounts are considered non-privileged, since they are given limited access to systems and data — and applies equally to role-based constructs: the inclusion of roles addresses situations where a change of role provides the same degree of assurance in the change of access authorizations as would be provided by a change between a privileged and non-privileged account.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- non-privileged accounts
- possessive
- non-privileged account's
- pluralpossessive
- non-privileged accounts'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 4 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A managed access credential (user account or role) whose authorization scope is restricted to ordinary, non-administrative tasks — that is, it carries only the permissions required for routine work and is explicitly excluded from security functions such as administering accounts, modifying audit configurations, managing cryptographic keys, or changing access authorizations. Standards such as NIST SP 800-53 AC-6(2) require users who also hold privileged accounts to switch to non-privileged accounts when performing nonsecurity functions, because operating continuously from a privileged account needlessly expands the attack surface. The concept extends to roles under role-based access control, where a change of role can provide the same boundary as a change between a privileged and non-privileged account. In practice, controls across NIST SP 800-53, SP 800-171, and CMMC all use the term as the complement of "privileged account" to enforce least privilege: users must use non-privileged accounts or roles when accessing nonsecurity functions, and are prevented from executing privileged functions from those accounts.DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A managed user or system account credential whose permissions are explicitly bounded to ordinary, non-administrative tasks — it cannot invoke security functions, modify system configuration, or access restricted data without a separate elevation step. As defined by NIST SP 800-53 (AC-6(2)) and NIST SP 800-171 (3.1.6), privileged accounts are granted elevated privileges to access resources — including security functions or security-relevant information — that are otherwise restricted for non-privileged accounts; a non-privileged account is therefore the contrasting account type that operates below that threshold. The field uses the term to enforce the principle of least privilege through dual-account practice: privileged users are required to use separate non-privileged accounts for routine tasks unrelated to system or security administration, and general computing activities — such as internet browsing, email, and productivity suite use — are conducted from the user's primary, non-privileged account (CIS Controls). The term encompasses any account type that sits below the privileged threshold — standard user accounts and guest accounts are considered non-privileged, since they are given limited access to systems and data — and applies equally to role-based constructs: the inclusion of roles addresses situations where a change of role provides the same degree of assurance in the change of access authorizations as would be provided by a change between a privileged and non-privileged account.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.