Business Requirement for Access Control

Access controls account for the security requirements of individual applications and the associated information managed by those applications.
Access controls adhere to the principles of “First deny all”, “Need to know”, and “Least privilege”
Information custodians are consider the required consistency between access controls and information classification levels.
Information custodians are consider all applicable security requirements when implementing access controls.
Access controls are implement standard user profiles for common job roles.
The risks associated with access control responsibilities are considered and segregation of duties are implemented as necessary to maintain appropriate “checks and balances.”