Secordit home
Contact

What is least privilege?

Least privilege means giving people and systems only the access they need to do the job, and no more. Access is taken away when the role changes. NCSC identity, insider-risk, and privileged-access guidance all point this way. Review permissions, protect admin accounts with strong MFA, and avoid everyday work in a powerful admin login. 123

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. Each person, and each system, gets only the access needed for the work they do. 13
  2. Admin accounts are protected with strong MFA, and are not used for everyday email or browsing. 31
  3. Access is reviewed, and removed, when someone leaves or changes role. 12

How it can look

Cyber Essentials includes user access control as one of its five technical controls. That means controlling who can access your data and services, and what level of access they have. For a small team, least privilege can be practical. Use separate logins, do not share an admin password on a sticky note, and remove access when someone leaves. 41

Warning signs

  • Everyone in a small team shares one admin login for everyday work. 13
  • An admin password is written on a sticky note, or reused on other sites. 13
  • A person who has left, or changed role, still has the same access as before. 12

What to do now

  1. Give each person their own login, and reserve admin access for the tasks that need it. 13
  2. Turn on strong MFA for admin accounts, and do not use those accounts for everyday email or browsing. 31
  3. Remove or reduce access when someone leaves or changes role, and review permissions from time to time. 12

UK reporting and support

  • If a privileged mailbox or admin account has been misused, follow the NCSC help for a hacked account, and see also business email compromise. 5
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 689
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 7
  • If someone is in danger, call 999. 89

How to protect yourself

  • Separate everyday work from admin tasks, with different accounts if you can. 3
  • Protect admin accounts with strong MFA, and with unique passwords. 31
  • Review access when people join, leave or change role. 12

Frequently asked questions

What does least privilege mean for a five-person company that shares one admin login?

It means moving away from that shared login. Give people their own accounts, and keep admin access for the tasks that need it. Protect those admin accounts with strong MFA, and remove access when someone leaves. 13

Is least privilege only for large IT teams?

No. For a small team it can be practical. Use separate logins, do not share an admin password on a sticky note, and remove access when someone leaves. 14

How does this relate to Cyber Essentials?

User access control is one of the five Cyber Essentials technical controls. 4

Matching kit

Joiners, Movers and Leavers Access Checklist · £19 · Digital download.

A printable checklist and editable access record for when people join, change role or leave. It does not replace your own access decisions.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, 10 Steps: Identity and access management | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Reducing data exfiltration by malicious insiders | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Use privileged access management | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. NCSC, Cyber Essentials overview | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  5. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  6. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  7. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  8. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  9. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).