Need to know

Need to know restricts access to a specific piece of information to the people who require it to carry out their assigned work. It originates in classified information handling, where the party holding the data decides whether a requester has an operational reason to receive it, and it is granted on that requirement rather than on rank, seniority or clearance level.

The distinction that matters is between eligibility and entitlement. A security clearance establishes that somebody has been vetted to handle information up to a given classification, which makes them eligible. Need to know is the further gate applied afterwards, asking whether this particular person needs this particular record now. The most senior person in an organisation still fails that test for material unrelated to their duties.

Where the check is enforced by the system from labels rather than by human approval, the mechanism is mandatory access control. A label carries a hierarchical classification level and non-hierarchical categories, and need to know is usually represented by the categories rather than the level. In Bell-LaPadula terms the levels drive no read up while the categories carry need to know, so a subject can hold ample clearance for the level and still lack the compartment.

Exam relevance: need to know is the expected answer where a scenario turns on justifying access to specific information, particularly where the subject is already cleared and authorised. Least privilege is the broader principle, asking for the minimum access and authority a task requires. Treat the split as emphasis rather than a hard boundary, since least privilege restricts access to information too. Need to know ends with the operational requirement that justified it.