Access to resources and records should be limited to authorized individuals, and accountability for their custody and use should be assigned and maintained.
Any and all individuals with an interest should have access to the resources and records