Technology 9. Least Privilege – Access to systems and data must be granted only as required and removed when no longer required.