| 💼 7.3.1 An access control system(s) is in place that restricts access based on a user's need to know and covers all system components. | | | 7 | | no data |
| 💼 7.3.2 The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function. | | | | | no data |
| 💼 7.3.3 The access control system(s) is set to “deny all” by default. | | | | | no data |