# NIST 800-171 3.13.3 Separate user functionality from system management functionality.

- Source: https://support.icompaas.com/support/solutions/articles/62000229336-nist-800-171-3-13-3-separate-user-functionality-from-system-management-functionality-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

System management functionality includes functions necessary to administer databases, network components, workstations, or servers, and typically requires privileged user access. The separation of user functionality from system management functionality is physical or logical. Organizations can implement separation of system management functionality from user functionality by using different computers, different central processing units, different instances of operating systems, or different network addresses; virtualization techniques; or combinations of these or other methods, as appropriate. This type of separation includes web administrative interfaces that use separate authentication methods for users of any other system resources. Separation of system and user functionality may include isolating administrative interfaces on different domains and with additional access controls. 

  

**  
Priority**: High   

  

**Category**:  Baseline Security Configurations 

  

**Services Associated with AWS:**   

-   AWS Identity and Access Management (IAM), AWS Virtual Private Cloud (VPC), AWS EC, Amazon RDS, Amazon WorkSpaces
-   AWS Identity and Access Management (IAM), AWS Cognito, AWS SSO
-   AWS Identity and Access Management (IAM), AWS WAF, AWS Shield, Amazon Route 

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations
-   Technical: screenshot of configuration settings 

  

Possible Technology Considerations : 

-   Secure Baseline Configurations (SBC)
-   Identity & Access Management (IAM)
-   Privileged Access Management (PAM) 

  

**What needs to be answered :**  

Are there controls to ensure that administration privileges are not available to general users? Is user functionality separated from system management functionality? 

-   Separation of User and System Management Functionality  
    Description: This check ensures that user functionality is separated from system management functionality. This includes using different computers, different central processing units, different instances of operating systems, different network addresses, or virtualization techniques.
-   Separate Authentication for User and System Resources  
    Description: This check verifies that separate authentication methods are used for users of system resources and those accessing web administrative interfaces. This helps maintain the separation between user and system management functionality.
-   Isolation of Administrative Interfaces  
    Description: This check ensures that administrative interfaces are isolated on different domains and with additional access controls, thus maintaining the separation between system and user functionality. 

  

**More Details:**   

User functionality separate from system management functionality.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.