What principle requires giving users the minimum level of access necessary?

What principle requires giving users the minimum level of access necessary?

• A. Interoperability Agreements
• B. Least Privilege
• C. Mandatory Vacation
• D. Business Partnership Agreement (BPA)

Answer: (B)

Giving users the minimum level of access necessary is the principle of least privilege. This approach reduces the potential damage from compromised credentials or misused permissions by ensuring an account can only perform the tasks it actually needs. In practice, apply least privilege by assigning permissions strictly to the role’s requirements, using role-based access control, and separating duties so no single account holds excessive power. When elevated access is truly needed, grant it temporarily through controlled, time-limited elevation rather than permanent broad rights. Interoperability agreements focus on compatibility between systems, not access control. Mandatory vacation is a control used to detect fraud, not to manage permissions. A Business Partnership Agreement governs collaboration terms, not user access.

Giving users the minimum level of access necessary is the principle of least privilege. This approach reduces the potential damage from compromised credentials or misused permissions by ensuring an account can only perform the tasks it actually needs. In practice, apply least privilege by assigning permissions strictly to the role’s requirements, using role-based access control, and separating duties so no single account holds excessive power. When elevated access is truly needed, grant it temporarily through controlled, time-limited elevation rather than permanent broad rights.

Interoperability agreements focus on compatibility between systems, not access control. Mandatory vacation is a control used to detect fraud, not to manage permissions. A Business Partnership Agreement governs collaboration terms, not user access.