UNCLASSIFIED  Ensure that access control measures maintain adherence to the Need-toKnow principle to make sure, that all times, individuals only have access to premises, information and staff they need to perform their jobs. In keeping with the mandated access management security outcome, organisations must review the appropriateness of access rights regularly; and  Have in place formal processes for investigating suspected non-compliance with security rules. Any such investigations, legal or disciplinary cases must comply with relevant laws, regulations and ethics. 44

Select target paragraph3