What does least privilege mean on the CPA exam?
Least privilege. Giving each user and process only the access it needs to do its job, and no more. It limits what an attacker can reach after a single account is compromised.
Defined against NIST SP 800-53 AC-6.
Which CPA exam sections use least privilege?
Least privilege appears in the ISC section of the CPA exam.
Related terms
- defense in depth: Layering independent controls so that no single failure exposes the asset.
- access control: Deciding who may reach what, and enforcing it.
- general IT control: A control over the entity's IT processes that supports the continued effective functioning of information-processing controls and the integrity of information.