Least privilege
Granting each user, process, or account only the access its task requires, and no more. Limits the damage from mistakes, malware, and compromised credentials alike.
Full guide: Need to Know vs Least Privilege: What Is the Difference?
Least privilege says every subject, whether a person, a service account, or a running process, should hold exactly the access its job needs and nothing more. The reasoning is blast-radius control: if an account can only reach what its task requires, then an error, a piece of malware running in its context, or a stolen credential can only do that much damage.
The principle runs through the whole CISSP material. It underpins separation of duties, which splits privilege across people, and it is the standing answer to over-permissioned service accounts, the very weakness Kerberoasting exploits when a cracked service account turns out to be a domain admin. It also pairs with need to know: least privilege governs the actions you can take, need to know governs the specific data you may see.
Exam relevance: least privilege is the reflexive best answer to “how should access be assigned” questions and to scenarios where an account had more rights than its role required. Distinguish it from need-to-know (data visibility) and from separation of duties (splitting a process). It is a preventive control aimed at containing, not detecting, misuse.