Need-to-Know is a security principle that restricts access to information to only those individuals who require it to perform their official duties. This concept is a core element of Access Control and is based on the idea that the less exposure sensitive information has, the lower the risk of it being compromised. It is a proactive measure to protect the confidentiality of information.
Example
- A human resources manager might have a need-to-know an employee’s salary and personal details.
- An IT system administrator might have a need-to-know the server credentials.
- A marketing professional would likely not have a need-to-know either of these pieces of information.
ISO 27001 Context
The Need-to-Know principle is a foundational aspect of ISO 27001 Annex A 5.15 Access Control in the ISO 27001 standard. It is often implemented through role-based access control (RBAC), where an individual’s access rights are determined by their job function and responsibilities. The principle ensures that even an authorised employee cannot access all data within an organisation.
