Need to Know Principle: Access Only When the Job Requires It

The term comes from military and government security. There, a person cleared for "secret" still cannot read every secret file. They only see the files their task requires. Today the principle is a core part of role and permission concepts in companies of every size.

Examples from everyday business

You can see the principle at work in many places:

• HR: Payroll staff see salaries. A recruiter does not need them for the job, so they stay hidden.
• Sales: A field rep sees the customers in their own region. Data on other regions stays locked.
• Projects: Files on a planned acquisition sit in a separate space. Only the project team has access.
• IT admin: An admin manages the file server. They can set up shares, but they do not read the board's documents.
• Vendors: An outside support tech gets access to the one system they look after, and only for as long as the contract runs.

Need to know vs. least privilege

Both principles limit access. But they look at different things:

• Need to know asks what: which information does this person need for the task?
• Least privilege asks how much: what is the smallest set of rights that gets the task done? Read, write, delete or admin.

Here is an example. Need to know says an accounts clerk may see the invoices of one client. Least privilege says the clerk may read and approve those invoices, but not delete them. In practice, you use both together.

Link to confidentiality

Of the three core security objectives, need to know mainly supports confidentiality. The fewer people who see a piece of data, the lower the risk that it leaks. That holds for honest mistakes, for insiders and for attackers who take over a user account. A hijacked account with little access does less harm.

This makes the principle a good fit for zero trust. There, too, nobody gets blanket trust. Each access is checked on its own and limited to what is needed.

How to apply the need to know principle

1. Classify your data: Sort information into levels such as "public", "internal", "confidential" and "strictly confidential". This shows you where tight rules matter most.
2. Build a role and permission concept: Define roles by task, not by person. Each role gets exactly the access it needs.
3. Enforce access in your systems: Set up the roles in your directory, file servers, ERP and cloud services. Identity and access management (IAM) helps you control this from one place.
4. Handle joiners, movers and leavers: New staff get the rights of their role. People who switch teams lose their old rights. People who leave lose all access on their last day.
5. Review access on a schedule: Data owners check at set intervals whether each permission is still needed. Anything nobody confirms gets removed.

Need to know in ISO 27001

ISO/IEC 27001 lists access controls in Annex A. In the 2022 version, these include:

• 5.12 Classification of information as the basis for setting protection needs and access
• 5.15 Access control with rules for physical and logical access based on business and security needs
• 5.18 Access rights for granting, reviewing and removing permissions
• 8.3 Information access restriction for enforcing limits in your systems

Need to know is not a control of its own. It is the yardstick you use to set the rules in these controls. Auditors often ask how you grant permissions and when you last reviewed them.

Need to know and the GDPR

The GDPR does not use the term. But it asks for what the principle delivers. Article 32 requires measures that ensure the ongoing confidentiality of systems and services. Article 25(2) goes further. By default, only the personal data needed for each purpose should be processed. The text says this also applies to who can access the data.

A permission concept based on need to know is good evidence for regulators. It shows that you limit access to personal data on purpose.

Common mistakes

• Access creep: Staff change teams and keep their old access. After a few years, they see far more than they need.
• Open shares: A folder is shared with "All employees" because that was the easy option.
• Rank over need: Managers get full access even though they only need part of the data.
• Forgotten accounts: Accounts of former staff or vendors stay active.
• No reviews: Permissions are granted but never checked again.

Frequently asked questions

Is need to know the same as least privilege?

No. Need to know limits which information a person can see. Least privilege limits which actions they can take on systems and data. The two work best together.

Does need to know apply to senior management?

Yes. Leaders carry the responsibility, but they do not need every record in detail. They should only access the information their role requires.

How often should you review access rights?

There is no fixed rule. Many companies review critical access more often than normal access, for example twice a year instead of once. What counts is that you set a schedule, stick to it and document the results.