Which principle requires giving users the minimum access necessary to perform their job?

Which principle requires giving users the minimum access necessary to perform their job?

• A. Need-to-Know
• B. Separation of Duties
• C. Least Privilege
• D. Principle of Maximum Privilege

Answer: (C)

Granting users only the access they need to perform their tasks is the principle of least privilege. This approach limits what a user can do and what data they can reach, so if a mistake happens or a credential is compromised, the potential damage is minimized. It also makes it easier to audit who had access to what, and it helps keep sensitive data, like cardholder data, from being exposed to more people than necessary, which aligns with PCI DSS goals. Need-to-know is related—it focuses on restricting access to data based on necessity for a given job function—but least privilege is the broader, foundational idea: privileges should be the minimum required for any task. Separation of duties is about dividing critical tasks among multiple people to reduce fraud risk, not about minimizing access for daily tasks. Maximum privilege is the opposite of what’s intended here; granting broad, unrestricted access increases risk.

Granting users only the access they need to perform their tasks is the principle of least privilege. This approach limits what a user can do and what data they can reach, so if a mistake happens or a credential is compromised, the potential damage is minimized. It also makes it easier to audit who had access to what, and it helps keep sensitive data, like cardholder data, from being exposed to more people than necessary, which aligns with PCI DSS goals.

Need-to-know is related—it focuses on restricting access to data based on necessity for a given job function—but least privilege is the broader, foundational idea: privileges should be the minimum required for any task. Separation of duties is about dividing critical tasks among multiple people to reduce fraud risk, not about minimizing access for daily tasks. Maximum privilege is the opposite of what’s intended here; granting broad, unrestricted access increases risk.