StudyToCert

All certifications / CC / Lessons

ISC2 Certified in Cybersecurity 2026 outline · Domain 3: Identity & access management concepts

Least privilege, need to know and separation of duties

▶ Watch the overview video

Last reviewed September 25, 2026 · Leer en español

Once a system knows who you are, it must decide how much access to give you. Three principles guide that decision and appear constantly on the CC exam: least privilege, need to know and separation of duties. They all limit the damage any one account or person can cause, whether through mistakes, malice or a stolen password.

Free account

Keep reading for free

Create a free StudyToCert account to read the rest of this lesson: 5 more sections, 5 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.

Sign up free Log in

Study CC for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the CC study plan