Need-to-Know is a security principle that restricts access to information to only those individuals who require it to perform their official duties. This concept is a core element of Access Control and is based on the idea that the less exposure sensitive information has, the lower the risk of it being compromised. It is a proactive measure to protect the confidentiality of information.
Example
- A human resources manager might have a need-to-know an employee’s salary and personal details.
- An IT system administrator might have a need-to-know the server credentials.
- A marketing professional would likely not have a need-to-know either of these pieces of information.
ISO 27001 Context
The Need-to-Know principle is a foundational aspect of ISO 27001 Annex A 5.15 Access Control in the ISO 27001 standard. It is often implemented through role-based access control (RBAC), where an individual’s access rights are determined by their job function and responsibilities. The principle ensures that even an authorised employee cannot access all data within an organisation.
Stuart Barker
Stuart Barker is qualified ISO 27001 Lead Auditor and a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
Now he is founder and Lead ISO 27001 Consultant at High Table, the worlds number 1 dedicated ISO 27001 Consultancy.
