Definition
Least privilege
In one sentence
Least privilege is the security principle that every user, application and system should have only the minimum access needed to do its job, for only as long as it is needed.
Least Privilege Explained
Least privilege limits the damage of any single compromise. If a phished user can only reach the files they need, the attacker can only reach those files too. If staff are not local administrators, malware they run cannot easily disable security tools or install persistence.
In small businesses, access tends to grow over time. People change roles and keep old permissions, everyone gets added to the "All Staff" share with full control, and admin rights are handed out to avoid help desk tickets. The result is that one compromised account can reach almost everything.
Practical steps include removing local admin rights, reviewing access to sensitive folders and systems at least annually, using groups based on roles rather than individual grants, limiting third-party and vendor access to what and when they need, and removing access promptly when people leave. Least privilege is a core principle of zero trust and appears in every major framework, including the CIS Controls, NIST CSF and ISO 27001.
General information for Canadian organizations, not legal advice.