Least Privilege
Also known as: Principle of Least Privilege · PoLP
Definition
The Principle of Least Privilege (PoLP) requires that every user, process, and program operate using the minimum set of privileges necessary to complete its task.
Least privilege is a foundational security principle that shows up in every major control framework — NIST 800-53 AC-6, ISO 27001 A.8.2, SOC 2 CC6.1, HIPAA 164.308. The practical implementation involves role design that maps cleanly to job functions, separation of administrative from non-administrative duties, and just-in-time elevation for privileged work.
Least privilege is a moving target: as people change roles, applications add features, and infrastructure evolves, what counts as "minimum necessary" shifts. Periodic access certifications + role mining are how mature programs keep up.