Least privilege
Least privilege is the principle that every account — human or machine — should hold only the access its job requires, and nothing more. Auditors test it in nearly every framework: SOC 2, ISO 27001, HIPAA, and CMMC all expect access granted by role, reviewed on a schedule, and revoked when no longer needed.
The security principle that every user, service account, and system should be granted only the minimum access required to perform its function, with permissions denied by default, reviewed regularly, and revoked when no longer needed.
Least privilege.
Glossary · Least PrivilegeThe principle, and why it holds up
The idea predates every compliance framework: grant the minimum, deny by default, elevate temporarily when a task genuinely needs more. A compromised account can only do what its permissions allow, so trimming permissions trims the blast radius of phishing, leaked tokens, and ordinary human error alike. The logic extends past people — service accounts, API scopes, and CI pipelines hoard permissions even more enthusiastically than employees do, and they never complain about losing them.
How auditors test it
No auditor tests a philosophy; they test artifacts. Expect requests for role definitions, provisioning tickets showing approval before access, results from a recurring access review, and offboarding records proving leavers lost access promptly. The sampling method is blunt and effective: pick a handful of employees, list everything they can touch, and ask the control owner to justify each grant. “That’s left over from their old team” is the answer that turns into a finding.
Why access drifts anyway
Permissions accumulate through ordinary motion. People change roles and keep old grants, incident responders receive emergency admin that never expires, and every new integration hands a service account another scope. Least privilege is therefore less a setting than a routine: a joiner-mover-leaver process wired into single sign-on, enforced with MFA, and pruned by reviews that actually revoke. The operational side of that routine is the subject of Policy and Access.
Glossary
Access reviews that actually revoke
Agency’s engineers pull the grants, chase the owners, and document every revocation — 200+ hours saved per year for teams that stop doing this by spreadsheet.
Platform Products
Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use.GRC IntegrationsEngineer-operated GRC platform integrationAuditsuisse AIAI-powered evidence collection and analysis for IT audits.Find your auditor
Auditnex makes buying audits simpler and more transparent.
Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.
Explore AuditnexCommon GRC Questions
GRC Platform & Virtual CISO FAQ
The long-form FAQ on how managed GRC and virtual CISO coverage work together.
Read the FAQMore from Agency
See it on the home pageBuild a Security & Compliance Team Led by Your Own Virtual CISO
Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.