Least privilege

Giving each user only the access their job needs.

Access should match job responsibilities, be approved by the data or business owner, and be reviewed regularly so that access no longer needed is removed, especially after role changes and departures.

On the exam

The best evidence that access is appropriate is a periodic review by business owners with proof that excess access was removed, not the policy that requires it.

Related terms

Segregation of dutiesSplitting key steps of a process so no one person can both commit and hide an error or fraud.
User access reviewA periodic check that everyone’s access is still right.

Test yourself with today’s question of the day.