In Episode 6 of my NIST SP 800-53 Rev 5 Access Control explanation series, I break down AC-6 (Least Privilege) and simplify what the control is really asking for. Least privilege is the principle that users—and processes acting on behalf of users (think service accounts)—only get the access they strictly need to do their assigned job. If you don’t need elevated rights to do your work, you shouldn’t have them. Period. I also walk through the intent behind the discussion section: applying least privilege not just to people, but to system processes, roles, and accounts so nothing runs at a privileged level higher than necessary. Then I touch on why this matters—least privilege reduces your attack surface and helps prevent malware from spreading across the network (especially when high-privilege accounts get compromised). Finally, I give you a practical assessment approach for SCA/self-assessments: review your Access Control Policy/Procedures, validate the AC-6 implementation in the SSP, and compare your Access Control List against your roles and responsibilities matrix. If the ACL says “admin” but the matrix says “regular user,” that’s where you ask questions, document justification, or flag the mismatch for remediation.