What does need-to-know mean?
Need-to-know ties knowledge of information to a task: whoever needs it for their current work may see it, and nobody else. The default is no access, and whoever wants access must justify it. When the task ends, the entitlement ends, even without a change of job.
In state protection of classified information, the principle is laid down in statute. § 4(1a) of the German Security Clearance Act (SÜG) provides (our translation): “Only persons who must have knowledge of classified information in order to perform their tasks may obtain knowledge of it.” There, a security clearance opens a classification level; which documents the person sees within that level depends on the task. A company works the same way: classification sets how strictly a data set must be protected, need-to-know sets who may look into it.
Need-to-know and least privilege: the difference
Need-to-know governs which information someone may know; least privilege governs which rights someone has to act on a system. Each can be breached independently of the other.
| Question | Need-to-know | Least privilege |
|---|---|---|
| Subject | the data set | the scope of rights on a system |
| Who decides | the business owner of the information | the operator of the system |
| Breach, example | a read-only account sees the entire HR data set without a task reason | a clerk works with administrator rights |
| Test question | Why may this person know this data set? | Why may this person carry out this operation? |
An account that can only read the full HR data set has minimal rights in the technical sense and still breaches need-to-know. Both checks therefore belong in access control.
Where is the need-to-know principle required?
| Framework | Provision | What it says |
|---|---|---|
| NIS2, entities under § 30(3) BSIG (such as cloud, data centre and managed service providers) | Annex point 11.2.2(a), Implementing Regulation (EU) 2024/2690 | grant and revoke access rights on the principles of need-to-know, least privilege and separation of duties; point 11.2.3: review at planned intervals and document the result |
| NIS2, other entities | § 30(2) sentence 2 no. 9 BSIG | concepts for access control; the Act does not use the term need-to-know |
| IT-Grundschutz | ORP.4.A2, Edition 2023 (in German) | assign user IDs and rights only according to actual need (least privilege and need-to-know); basic requirement |
| GDPR | Article 25(2), Article 29, Article 32(4) | default settings also limit accessibility to what is necessary; persons acting under the controller's authority process data only on instructions |
| Classified information | § 4(1a) SÜG | knowledge only where the task requires it |
Financial entities under DORA and certain telecommunications and energy companies are in principle exempt from § 30 BSIG (§ 28(5) and (6) BSIG). Data protection law does not use the term itself; the substance follows from Article 25(2) together with data minimisation under Article 5(1)(c) GDPR.
How to check need-to-know for a data set
Check a business data set, not a server: payroll data, job applications, draft contracts.
- Name the owner of the data set in the business unit. IT implements; it does not decide who is in the circle.
- Export all accounts with read access, including through nested groups, reports, exports, test systems and service providers' accounts.
- Enter the role and task reason for each account and have the owner confirm or reject each line.
- Revoke rejected access, export again and compare the two states.
Fictional example: payroll data in the HR system, 14 accounts with read access. The figures are invented for illustration.
| Accounts | Role | Task reason | Owner's decision |
|---|---|---|---|
| 6 | Payroll | monthly payroll run | confirmed |
| 2 | HR management | setting salaries | confirmed |
| 3 | Department heads | none for individual salaries; budget planning needs totals | revoked, replaced by a totals report per department |
| 1 | Project account of the 2025 system migration | project closed | revoked |
| 2 | System administration | operating the system, not its content | read access to content revoked, technical rights remain |
Expected after the clean-up: eight accounts, each with a confirmed reason. Keep both exports and the decisions with name and date; this is the documented review result that Annex point 11.2.3 requires. Schedule the next review, plus an event-driven one at every change of role. How this check fits into building an ISMS is shown in the guide ISMS implementation.
The data set and its owner in Rizzqo
In Rizzqo, you hold the data set you check for need-to-know as a primary asset of type information. An owner can be assigned to it, such as the person in the business unit who decides who is in the circle; the asset carries a confidentiality rating and the personal-data flag.
The systems that hold the data set are supporting assets and inherit exactly these two attributes. The requirements from the ISO/IEC 27001 and ISO/IEC 27002 catalogues attach to them by asset category and subcategory. The owner answers them and finalises each answer with name and timestamp; a finalised “not fulfilled” answer is a gap, and Rizzqo computes coverage from the finalised answers.