---
title: What is the principle of “least privilege”? And should you be following it?
description: This Q&A looks at the principle of “least privilege” so you can start to think about implementing it successfully in your own organisation.
image: https://blog.grantmcgregor.co.uk/hubfs/least%20privilege.png
---
[](https://www.grantmcgregor.co.uk/)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
[Contact Us](https://grantmcgregor.co.uk/contact-us)
[Back to main](https://grantmcgregor.co.uk/knowledge-hub/blog)
Digital Transformation
# What is the principle of “least privilege”? And should you be following it?
Grant McGregor Team
12 October 2020 • 5 min read
**You might have heard or read about the principle of least privilege in the context of cyber security – especially if you have looked into the Cyber Essentials scheme. This blog looks at why it’s important and how it can be implemented successfully.**
# This Q&A is designed to introduce the principle of “least privilege” in a straightforward way so you can start to think about implementing it successfully in your own organisation.
### What is least privilege?
Least privilege is an approach to access rights management that aims to reduce an organisation’s exposure to risk and, in particular, the risk of cyber-attack.
The core principle of a least privilege approach is to deny users and applications access to files, folders, systems, applications and areas of the network unless they need to access them for their job.
### Why is a principle of least privilege important?
Least privilege is important because it is designed to limit your organisation’s exposure to cyber risks.
Cyber criminals target user accounts with privileged access rights because they have greater network access. Once hackers have privileged access, they can move across the network at will. It’s then easy for them to get to your most desirable systems and data.
By limiting access for the majority of users, you can deny hackers the ability to do this easily.
### Are there other reasons for adopting a least privilege approach?
As well as the immediate advantage of reducing your potential attack surface, adopting a least privilege approach is important for several different compliance scenarios.
If you have compliance regulations to meet, such as HIPAA, PCI-DSS, SOX, FISMA, FedRAMP, CCPA or voluntary codes such as NIST or ISO, auditors and government agencies will be looking at the ways you are reducing risk within your organisation. Limiting user access rights is a good way to reduce risk.
Being able to demonstrate that you are following this principle can help with proof that you are taking measures to protect data in the event of a data breach, which is important under GDPR.
It’s also a key element within the [UK Government’s Cyber Essentials scheme](https://info.grantmcgregor.co.uk/getting-started-with-cyber-essentials-isnt-complicated).
### How does least privilege work?
Least privilege requires you to limit every user’s access and application. Each should only be allowed to access the systems and data that are absolutely necessary to accomplish their day-to-day work.
Permissions and privileges must be carefully controlled.
Often this is achieved through the development of allow lists, deny lists and restrict lists.
### To whom should least privilege apply?
Least privilege should apply to every user.
And to every application.
### What about my executive team?
The rights of your executive team and other high-profile users should be managed even more tightly than those of others.
[Spear-phishing attacks](https://blog.grantmcgregor.co.uk/2019/the-10-phishing-red-flags-your-people-need-to-know-about-right-now) will target users in finance, IT and leadership roles, because they often have privileged access rights, or have access to the most desirable systems and/or data. By locking down the access those users enjoy to only the systems they really need, in the event of their user accounts being compromised, you have limited the data and systems to which the hacker has access and thus limited the damage they can cause.
### What are the most important factors to consider to ensure the success of a least privilege approach?
• Communication is key – you need to ensure that budget holders, other stakeholders and your users are onside. As with any change, users need to understand what is happening and why.
• Be prepared to deal with any pushback that may arise from you taking away user rights. Give users information about how to contact the helpdesk immediately if they encounter any problems.
• Effective planning is also essential. You need to ensure that access rights are minimised, while ensuring that the removal of access rights does make it difficult for users to undertake their everyday work.
Finding the right balance between locking down your environment without hampering productivity will require a good understanding of users’ roles and requirements. If done well, users shouldn’t even notice that their rights have been removed.
• Least privilege needs to be applied to everyone – no exceptions. This may mean disabling local administrators’ rights to elevate privileges. You don’t want rogue IT support staff handing out extra access rights to users just because they happened to ask nicely.
You need to ensure your local IT team ([or your outsourced IT support company](https://www.grantmcgregor.co.uk/)) is fully signed up to enforcing the approach, so training may be something you want to consider.
• Least privilege is not a time-limited project – it has to be an ongoing approach. As users leave, start, change roles, and require different access rights, the management of their rights will need to be continually managed and updated.
Similarly, as applications change and are upgraded, they may also need different permissions and access rights given to or removed from them.
You can’t assume that users and / or applications will need access rights forever, so you should continually revisit user requirements to identify opportunities to reduce privileges further.
### How can I go about implementing the principle of “least privilege” in my organisation?
Probably the best advice is don’t consider doing it in isolation. This should be part of your overall IT security posture and culture. Improving your IT security – even privileged access - isn’t a one-off event or project but part of an overall stance to make data security something that’s always considered and prepared for.
If you would like to discuss how you can begin to adopt an approach of least privilege, our team are on hand to help. But why not use it as part of a broader discussion about your stance on security? [Reach out](https://www.grantmcgregor.co.uk/contact-us/) to us on 0808 164 4142 for a no-nonsense initial chat about where to begin...
Grant McGregor Team
12 October 2020 • 5 min read
## Recent Posts
### Shadow AI: Is Your Business Ready for AI Adoption?
Understand shadow AI's impact on your business. Discover how to assess risks, improve processes, and adopt AI securely w...
[Read More](https://blog.grantmcgregor.co.uk/shadow-ai-is-your-business-ready-for-ai-adoption)
### Our Net Zero Target for 2040: What Can We Change?
From company vehicles and travel to suppliers and technology, see how Grant McGregor is working towards its net zero tar...
[Read More](https://blog.grantmcgregor.co.uk/our-net-zero-target-for-2040-what-can-we-change)
### What Is Penetration Testing? A Guide for Businesses
Learn what penetration testing is, how it works, what the report should include and when your business should consider a...
[Read More](https://blog.grantmcgregor.co.uk/what-is-penetration-testing-a-guide-for-businesses)
### Grant McGregor Recognised as a Leading Global MSP in the 2026 MSP 501
Grant McGregor has been named a Top Global Managed Service Provider in the 2026 MSP 501, ranking #1 Scotland-based MSP a...
[Read More](https://blog.grantmcgregor.co.uk/grant-mcgregor-recognised-as-a-leading-global-msp-in-the-2026-msp-501)
Union
## Empower your business with secure, expert-led solutions.
Talk to us about people-focused technology that drives results.
[Start a conversation](https://grantmcgregor.co.uk/contact-us)
Premium IT Services Tailored for Leading Brands
[Follow us on LinkedIn](https://www.linkedin.com/company/grant-mcgregor-ltd/) [Follow us on Facebook](https://www.youtube.com/itgrantmcgregor) [Follow us on Facebook](https://www.facebook.com/grantmcgregorltd/) [Follow us on Twitter](https://x.com/GrantMcGregorIT)
Quick Links
- [Home](https://grantmcgregor.co.uk)
- [About us](https://grantmcgregor.co.uk/about-us/our-story)
- [Knowledge Hub](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
Services
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
Edinburgh – Chesterfield
[0131 603 7910](tel:+441316037910)
[info@grantmcgregor.co.uk](mailto:info@grantmcgregor.co.uk)
**Main Office:**
The Merchants' Hall,
22 Hanover St,
Edinburgh EH2 2EP
© 2026
Grant McGregor. All rights reserved.
[Privacy and Cookie Policy](https://blog.grantmcgregor.co.uk/hubfs/UsefulDownloads/Policies/GRMC-SEC-Privacy-and-Cookie-Policy.pdf)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Grant McGregor Team",
"url" : "https://blog.grantmcgregor.co.uk/author/grmc-team"
},
"dateModified" : "2020-10-12T07:30:00.764Z",
"datePublished" : "2020-10-12T07:30:00.000Z",
"headline" : "What is the principle of “least privilege”? And should you be following it?",
"image" : [ "https://blog.grantmcgregor.co.uk/hubfs/least%20privilege.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.grantmcgregor.co.uk/what-is-the-principle-of-least-privilege-and-should-you-be-following-it",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg"
},
"name" : "Grant McGregor"
}
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://grantmcgregor.co.uk/",
"@type" : "LocalBusiness",
"address" : {
"@type" : "PostalAddress",
"addressCountry" : "GB",
"addressLocality" : "Edinburgh",
"postalCode" : "EH2 2EP",
"streetAddress" : "22 Hanover Street"
},
"geo" : {
"@type" : "GeoCoordinates",
"latitude" : 55.9526313,
"longitude" : -3.1970679
},
"image" : "https://grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg",
"name" : "Grant McGregor",
"openingHoursSpecification" : {
"@type" : "OpeningHoursSpecification",
"closes" : "18:00",
"dayOfWeek" : [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ],
"opens" : "08:00"
},
"sameAs" : [ "https://www.facebook.com/grantmcgregorltd/", "https://x.com/GrantMcGregorIT", "https://www.youtube.com/itgrantmcgregor", "https://www.linkedin.com/company/grant-mcgregor-ltd/" ],
"telephone" : "+441316037910",
"url" : "https://grantmcgregor.co.uk/"
}
```