NIST 800-53 REV 5 • ACCESS CONTROL
AC-2(6) — Dynamic Privilege Management
Implement {{ insert: param, ac-02.06_odp }}.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
Supplemental Guidance
In contrast to access control approaches that employ static accounts and predefined user privileges, dynamic access control approaches rely on runtime access control decisions facilitated by dynamic privilege management, such as attribute-based access control. While user identities remain relatively constant over time, user privileges typically change more frequently based on ongoing mission or business requirements and the operational needs of organizations. An example of dynamic privilege management is the immediate revocation of privileges from users as opposed to requiring that users terminate and restart their sessions to reflect changes in privileges. Dynamic privilege management can also include mechanisms that change user privileges based on dynamic rules as opposed to editing specific user profiles. Examples include automatic adjustments of user privileges if they are operating out of their normal work times, if their job function or assignment changes, or if systems are under duress or in emergency situations. Dynamic privilege management includes the effects of privilege changes, for example, when there are changes to encryption keys used for communications.
Practitioner Notes
Dynamic privilege management means the system adjusts access in real time based on conditions like risk level, location, or threat intelligence. Access is not static — it changes as the situation changes.
Example 1: In Azure AD, configure Conditional Access → Conditions → Sign-in risk to require MFA when the risk level is medium or higher, and block access entirely when risk is high. Azure's Identity Protection uses machine learning to detect anomalous sign-in patterns and adjust requirements automatically.
Example 2: Deploy CrowdStrike Falcon Identity Protection (or a similar tool) to monitor privileged account behavior in real time. When it detects lateral movement patterns or credential misuse, it can automatically step up authentication requirements or suspend the session until a security analyst investigates.