Least-privilege checklist builder

How to use it

Untick the environments you don't run, then work down the list. Ticks are saved in this browser only (local storage), so you can come back to it; nothing is sent anywhere. Download Markdown gives you a file to paste into a ticket, a wiki page or a pull request.

Where the items come from

Each item cites the NIST SP 800-53 Rev. 5 control it implements: AC-2 (account management) and its enhancements for temporary accounts (AC-2(2)), disabling accounts (AC-2(3)), audit (AC-2(4)), privileged user accounts (AC-2(7)), shared accounts (AC-2(9)) and atypical use (AC-2(12)); AC-5 (separation of duties); AC-6 (least privilege) and its enhancements for non-privileged accounts for everyday work (AC-6(2)), network access to privileged commands (AC-6(3)), restricting privileged accounts (AC-6(5)), reviewing privileges (AC-6(7)), logging privileged functions (AC-6(9)) and preventing non-privileged users from running privileged functions (AC-6(10)); and IA-2, IA-5 and IA-9 for authentication of people and services. SP 800-53 leaves the values (how often, how long, which roles) for each organization to set.

Items marked common practice are widely recommended but are not a specific control requirement; the page that explains them says so. Phishing-resistant MFA for administrators follows CISA's Implementing Phishing-Resistant MFA fact sheet.

Where to start

If the list is long, the order that usually removes the most risk first: inventory (you can't reduce what you can't see), MFA that resists phishing on every privileged account, separate admin accounts, then removing standing privilege with just-in-time elevation. The background is on least privilege, privileged accounts and just-in-time access.

Sources

1. NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, NIST. Public domain (U.S. government work).
2. Implementing Phishing-Resistant MFA (fact sheet, October 2022), CISA. Public domain (U.S. government work).