UNCLASSIFIED
Ensure that access control measures maintain adherence to the Need-toKnow principle to make sure, that all times, individuals only have access to
premises, information and staff they need to perform their jobs. In keeping
with the mandated access management security outcome, organisations
must review the appropriateness of access rights regularly; and
Have in place formal processes for investigating suspected non-compliance
with security rules. Any such investigations, legal or disciplinary cases must
comply with relevant laws, regulations and ethics.
44