Overview#
The term "Need to know", when used by government and other organizations (particularly those related to the military or spying), describes the restriction of data which is considered very sensitive. Under need-to-know restrictions, even if one has all the necessary official approvals (such as a security clearance) to access certain information, one would not be given access to such information, or read into a clandestine operation, unless one has a specific need to know; that is, access to the information must be necessary for the conduct of one's official duties.As with most security mechanisms, the aim is to make it difficult for unauthorized access to occur, without inconveniencing legitimate access. Need-to-know also aims to discourage "browsing" of sensitive material by limiting access to the smallest possible number of people.
The Battle of Normandy in 1944 is an example of a need-to-know restriction. Though thousands of military personnel were involved in planning the invasion, only a small number of them knew the entire scope of the operation; the rest were only informed of data needed to complete a small part of the plan. The same is true of the Trinity project, the first test of a nuclear weapon in 1945.
This term also includes anyone that the people with the knowledge deem necessary to share their knowledge with.
Some Related Efforts#
- Principle of least privilege
- Privacy by Design
- User Managed Access
- Law of Minimal Disclosure For A Constrained Use
Need to know should be considered a Law and a consideration when designing any system.
More Information#
There might be more information for this subject on one of the following:- Access Control Policy
- IDM Related Compliance Items
- Law of Minimal Disclosure For A Constrained Use
- Payment Card Industry Data Security Standard
- Principle of least privilege
- Treatment, Payment and Health care Operations
- United States Privacy Act
- [#1] - Need to know
- based on information obtained 2013-04-10