Need to Know
What is Need to Know?
A security principle that restricts access to information to only those individuals who require it to perform their specific job duties.
Terms that appear alongside need to know
Each of these is named in at least one of the same controls as need to know. The number is how many controls name both.
- access control 17 shared controls
- authentication 7 shared controls
- least privilege 7 shared controls
- access management 5 shared controls
- nist 5 shared controls
- audit 5 shared controls
- nist sp 800 53 4 shared controls
- encryption 4 shared controls
Frameworks that govern need to know
What the standards actually require on need to know
Requirements naming need to know across 6 standards, quoted from the control text.
Agencies must restrict any network documentation given to a third party, such as a contractor or commercial provider, to only what that party needs to perform its contracted services and functions, in line with the need-to-know principle.
new-zealand-information-security-manual-nzism::18.1.9.C.03 · 18.1.9.C.03 Limit third-party network documentation to need-to-know →One or more access control systems must be in place that limit access according to each user's need to know and that cover every system component.
pci-dss-4-0::7.3.1 · 7.3.1 Need-to-know access control system covers all components →Requirement 0131 (Part Five: Personnel, section 17.2 Access to Resources; applies to All entities; dated 31 October 2024; retained from Release 2025): Access to security classified information or resources is only given to entity personnel with a need-to-know...
protective-security-policy-framework-pspf-release-2026::0131 · 0131 Need-to-know for classified access →The plan must require that protection technology effectiveness measurements are authorised, validated and given confidentiality, integrity and availability protection in line with their classification and that risk to them is identified.
api-1164::PR.IP-8 · PR.IP-8 Protection technology effectiveness measurements protected and shared on need to know →The need-to-know principle is enforced for database contents through the application of minimum privileges, database views, database roles and data tokenisation.
ISM-1268 · Need-to-know enforcement for database contents →Make personal data available internally only to specifically authorized users, each with access limited to what their tasks need.
ilo-code-of-practice-on-the-protection-of-workers-personal-data-1997::10.6 · 10.6 Need-to-know internal access →Questions people ask about need to know
What is Need to Know?
Why is Need to Know important for compliance?
Which compliance frameworks address Need to Know?
Where can I learn more about Need to Know?
See how Need to Know applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.