7.2.1—An access control model is defined and includes granting access as follows: Appropriate access depending on the entity’s business and access needs.

>Requirement Description

An access control model is defined and includes granting access as follows: Appropriate access depending on the entity’s business and access needs. Access to system components and data resources that is based on users’ job classification and functions. The least privileges required (for example, user, administrator) to perform a job function.