Least privilege

FDA expects device security architectures to apply it, for example by separating clinician, service and administrator access. It limits the damage if one account or process is compromised.

a security principle that a system should restrict the access privileges of users (or processes acting on behalf of users) to the minimum necessary to accomplish assigned tasks.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology