Least privilege
Least privilege is the rule that each person gets only the access they need to do their current job, and nothing more. The Danzell question set says Cyber Essentials requires 'that the principle of least privilege be applied'. A7.4 asks how you make sure staff only have the access they need, and A7.9 asks whether admin access is reviewed regularly.
- Term
- Least privilege
- Also known as
- Principle of least privilege, PoLP, Need to know access
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term least privilege mean in Cyber Essentials?
Least privilege is the rule that each person gets only the access they need to do their current job, and nothing more.
provide access to only those applications, computers and networks that the user needs to carry out their role
How does least privilege apply to Cyber Essentials?
In plain terms
A receptionist does not need the keys to the server cupboard, and a salesperson does not need the payroll folder. Least privilege simply means handing out only the keys each role needs. When someone moves from sales to finance, they get the finance access and lose the sales access they no longer use.
What Cyber Essentials asks
One of the two aims of the user access control section is that user accounts "provide access to only those applications, computers and networks that the user needs to carry out their role". The requirements explain why: if a user opens a malicious link or attachment, the malware usually runs with that user's level of access, so less access means less damage.
In the question set:
- A7.4 asks: "Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?" The guidance states: "For Cyber Essentials we require that the principle of least privilege be applied."
- A7.6 and A7.7 apply the same idea to admin rights: admin work in a separate account, never used for email or browsing.
- A7.9 asks whether you regularly review who should have admin access.
What an assessor looks for
A7.4 is a written answer. A good one names how access is set, for example by role-based groups or shared folders per team, and who changes it when someone changes job. "Everyone has access to everything" does not meet the requirement.
See least privilege and admin approval and A7.4. Related: privileged access, standard user account, joiners, movers and leavers.
Related terms
- Privileged accessPrivileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
- Standard user accountA standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.
- Joiners, movers and leavers (JML)Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- PasskeyA passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN.
- PassphraseA passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember.
Frequently asked questions
Least privilege is the rule that each person gets only the access they need to do their current job, and nothing more. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, least privilege comes up at A7.4, A7.9. Read those questions against the definition above so your answers use the term the way the assessor will.
Least privilege relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.