Which security principle states that more than one person is required to perform a critical task?

Due diligence refers to the ongoing practice of applying reasonable care and thoroughness to security responsibilities, not to requiring multiple approvers for tasks.

Separation of duties mandates that no single individual can control all phases of a sensitive operation - for example, one person initiates a financial transaction while another approves it. This control is designed to detect and deter collusion, accidental errors, and malicious insider activity by requiring collaboration or oversight. It is a core principle in both access control frameworks and compliance standards such as SOX and PCI-DSS.

Need to know is an access control principle limiting information access to those who require it for their role, unrelated to requiring multiple participants for a task.

Least privilege restricts user permissions to the minimum necessary to perform their job function, but does not mandate multi-person involvement in task execution.