CC6.3 CC6
Logical and Physical Access Controls / CC6.3
Changing and removing access when roles change
In plain English
Access is modified or revoked as people join, move and leave, and it is reviewed periodically so that permissions do not quietly accumulate over a long career.