NISTNIST CSFProtect FunctionEASYFree question
What is the principle of least privilege and how does it apply to the Protect function?
- A.Requiring every employee to complete the same generic training module, and postponing any customization for higher-risk roles indefinitely
- B.Granting new hires standing access to the shared drives, and reviewing that broad access only during the annual audit cycle each year
- C.Assigning permissions once at hiring, and revisiting them only when a formal written complaint happens to be filed by a manager
- D.Granting users, processes, and systems only the minimum access permissions necessary to perform their functions, reducing the potential impact of compromised accounts or insider threats
Why D is correct
Least privilege limits access to what is strictly necessary, reducing the attack surface and potential damage from compromised accounts, malware, or insider threats.
Know someone studying for NIST CSF? Send them this one.