Access to resources and records should be limited to authorized individuals, and accountability for their custody and use should be assigned and maintained.
By limiting access to just a few, it'll be easier to enforce accountability concerning the custody of the records and resources