Restrict Access to System Components by Business Need to Know

1	Processes and mechanisms for restricting access to system components in scope are defined and understood.
2	principle of minimal privilege is implemented.
3	Access to system components and data is appropriately defined and assigned.
4	Access to system components and data is managed via an access control system(s).