What requirement in the Access Control section of the NIST SP 800-171 2nd revision requires preventing non-privileged users from executing privileged functions and capturing that execution in audit logs?
The requirement is 3.1.7.
That requirement is 3.1.7 and is found in the Access Control section.