The National Institute of Standards and Technology (NIST) defines least privileged access as 'seek(ing) to ensure the right people and things have the right access to the right resources at the right time.' Privilege creep breaks the principle of least privilege, preventing an organization from adhering to many standards and regulations, including the ISO 27001 access control policy.