Need to Know
What is Need to Know?
A security principle that restricts access to information to only those individuals who require it to perform their specific job duties.
Terms that appear alongside need to know
Each of these is named in at least one of the same controls as need to know. The number is how many controls name both.
- access control 17 shared controls
- authentication 7 shared controls
- least privilege 7 shared controls
- access management 5 shared controls
- nist 5 shared controls
- audit 5 shared controls
- nist sp 800 53 4 shared controls
- encryption 4 shared controls
Frameworks that govern need to know
What the standards actually require on need to know
Requirements naming need to know across 6 standards, quoted from the control text.
The need-to-know principle is enforced for database contents through the application of minimum privileges, database views, database roles and data tokenisation.
ISM-1268 · The need-to-know principle is enforced for database contents through the application of mi →An access control system(s) is in place that restricts access based on a user's need to know and covers all system components
pci-dss-4-0::7.3.1 · An access control system(s) is in place that restricts access based on a user's need to know and covers all system components →Configure data access control lists based on a user's need to know. Apply ACLs on file systems, databases, and applications.
3.3 · Configure Data Access Control Lists →Give cloud users a roles and rights concept for managing access, describing the rights profiles available for each service function so that permissions can follow least privilege and need to know, and operational duties can be kept separate from controlling on...
C5-PSS-08 · Roles and Rights Concept →Configure data access control lists based on a user’s need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.
CIS-3.3 · Configure Data Access Control Lists →Track and report vulnerability identification and remediation activity, including notification to the stakeholders who need to know.
CCM-TVM-09 · Vulnerability Management Reporting →Questions people ask about need to know
What is Need to Know?
Why is Need to Know important for compliance?
Which compliance frameworks address Need to Know?
Where can I learn more about Need to Know?
See how Need to Know applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.