Security principle restricting access to information only to those who require it for their work.
Need to know is the principle that access to sensitive information should be limited to those who require it to perform their duties—regardless of clearance level. Having clearance doesn't automatically grant access; you must also have a legitimate need. Need to know limits the impact of compromise and prevents unnecessary exposure. It applies at all classification levels and is fundamental to information security in government and defence contexts.
Why It Matters
The DSC Perspective:
Clearance enables potential access; need to know determines actual access. Apply need to know rigorously—don't share sensitive information just because someone has appropriate clearance. This limits damage from insider threats and compromises.