Assessment objective [a] for AC.L2-3.1.7 requires the assessor to verify that "Privileged functions are defined." The most direct and authoritative evidence for a formal definition is found within an organization's documented specifications. Security policies establish the high-level rules and requirements, while system design documentation provides the detailed technical specifications, including which specific commands, system calls, or application functions are designated as privileged. These documents serve as the foundational "Specification" assessment objects that an assessor must examine to confirm that the Organization Seeking Certification (OSC) has formally defined what constitutes a privileged function within their environment.

A. Interviews with System Developers: Interviews assess an individual's knowledge or an activity's performance, but they do not serve as the formal, documented definition required by the assessment objective.
B. User acknowledgements of notification message or banner: This evidence relates to user awareness and consent to monitoring (e.g., AC.L1-3.1.1), not the definition of privileged system functions.
D. System use notification messages: These are mechanisms for informing users of terms of use and monitoring; they do not contain the technical definitions of privileged functions. ---

1. Cybersecurity Maturity Model Certification (CMMC) CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.1 (October 25, 2023): Section 3.3, "Assessment Methods," describes the "Examine" method as "the process of reviewing, inspecting, observing, studying, or analyzing one or more assessment objects." To verify a definition, an assessor would primarily use the "Examine" method on "Specification" objects like policies and design documents.

2. CMMC Model Level 2 Assessment Guide (December 2021): For practice AC.L2-3.1.7, Assessment Objective [a] is "Privileged functions are defined." The guide's methodology directs assessors to seek evidence for each objective. The primary evidence for a definition is documentation. The "Potential Assessment Objects and Methods" section for this practice would list "Specifications" (e.g., security policies, system design documentation, list of privileged functions) as key evidence to be examined for objective [a].

3. NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (February 2020): CMMC Level 2 is aligned with this publication. The discussion for control 3.1.7 states, "Privileged functions include, for example, establishing system accounts... The organization defines the privileged functions that are to be restricted to authorized individuals." This explicitly places the responsibility of defining these functions on the organization, which is accomplished through policy and documentation.

4. NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (September 2020): The parent control for CMMC's AC.L2-3.1.7 is AC-6, "Least Privilege." The assessment procedures for control objective AC-6(a), "The organization authorizes access for privileged functions," direct assessors to "Examine: Policy and procedures addressing least privilege; system security plan; account management procedures..." This confirms that policies and system documentation are the primary objects for examination.