Clerk cannot open security workbench
Front-desk role has no path — UI or API — to edit access roles; attempts return authorization errors logged for review.
AC-6(10) Prohibit Non-Privileged Users from Executing Privileged Functions
Critical Risk
Moderate
Low Cost
AC-6(10) requires prohibiting non-privileged users from executing privileged functions to include disabling, circumventing, or altering security safeguards. This is the enforcement twin of least privilege: a registration clerk must not run EHR security tools, a nurse must not disable EDR, and a standard cloud user must not elevate to modify IAM policies. Technical denial — not only policy — is required.
Control Objective
Ensure non-privileged users cannot execute, disable, or bypass privileged security and administrative functions on systems that create, receive, maintain, or transmit ePHI.
Implementation Guidance
- Enforce OS controls: no local admin, UAC/app control, block disablement of security agents.
- Enforce application RBAC so security/admin modules are unreachable to standard roles (AC-3(1)/AC-3(7)).
- Lock security tool uninstall via MDM/GPO; alert on tamper attempts.
- Deny privileged API scopes to non-admin OAuth apps and users.
- Harden break-glass so it does not create a silent path for non-privileged users without AC-3(10) auditing.
- Test 'negative cases' after each EHR and OS image update.
- Remove debug/backdoor accounts that allow privilege bypass.
- Review cloud role assignments for privilege escalation paths (e.g., Owner via group nesting).
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
User cannot turn off EDR
Standard clinical Windows image blocks agent stop/uninstall; tamper event alerts SOC.
Standard Entra user cannot grant admin roles
Only Privileged Role Administrators assign elevated directory roles; self-service elevation is off except through governed PIM packages.
Best Practices
- Deny-by-default privileged functions.
- Protect security agents from user tamper.
- Test negative authorization cases.
- Close privilege-escalation paths in cloud IAM.
- Log and alert denied privileged attempts where noisy-but-useful.
- Re-validate after platform upgrades.
Common Gaps & Violations
- Security menus hidden but API still callable.
- Users can uninstall antivirus locally.
- Nested cloud groups grant unexpected Owner.
- 'Power user' local rights allow driver loads that bypass controls.
- Debug accounts left from go-live with privileged functions.
Required Documentation
- Technical enforcement standard for privileged function prohibition
- Endpoint hardening baseline (no admin / agent tamper protection)
- Application RBAC evidence for admin module denies
- Cloud privilege-escalation review records
- Negative test results after major changes
How to Test & Validate
- As a standard clinical user, attempt privileged EHR and OS actions; confirm deny.
- Attempt to stop/uninstall security agents; confirm block + alert.
- Review cloud role graph for escalation to privileged roles.
- Call privileged APIs with a non-admin token; confirm 403.
- Re-test after EHR upgrade for newly exposed admin functions.
Audit Considerations
Live negative testing is persuasive evidence. Policy statements without technical denial fail AC-6(10). Assessors may ask staff to demonstrate a denied privileged action.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.312(a)(1) Access Control — only authorized persons/software; non-privileged users must be blocked from admin functions.
- 164.308(a)(5)(ii)(B) Protection from Malicious Software — users must not easily disable protective tools.
- 164.312(b) Audit Controls — denied and privileged attempts support monitoring.
- 164.308(a)(1) Risk Management — prevent circumvention of safeguards.
Compliance Tips
- Add negative access tests to EHR upgrade checklists.
- Treat security-agent tamper alerts as high priority.
- Periodically graph cloud role nesting for hidden privilege.
Frequently Asked Questions
How is this different from AC-3(1)?
Closely related. AC-3(1) emphasizes restricted access to privileged functions; AC-6(10) emphasizes prohibiting non-privileged users from executing them as a least-privilege enhancement.
What about users who 'need admin once'?
Use JIT privileged accounts (AC-6(5)) rather than making their daily ID privileged.
Do mobile clinical apps count?
Yes — ensure patients and standard users cannot invoke admin or safeguard-disable functions via the app.
References & Resources
- NIST SP 800-53 Rev. 5 — AC-6(10)
- Related: AC-3(1), AC-6, AC-6(2), AC-6(5), CM-7, SI-4
Related Guidelines
Related controls that commonly accompany AC-6(10).
Need Help Implementing AC-6(10)?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.