Question: what is the difference between least privilege and need to know?
Answer: Need to know and least privilege are two of the foundational principles of cybersecurity. Need to know limits information access to the information that an individual requires to carry out his or her job responsibilities. Least privilege extends this concept to system privileges.