"Access rights to information and other associated assets shall be provisioned, reviewed, modified and removed in accordance with the organization’s topic-specific policy on and rules for access control."[1]

To provide and maintain user access to systems and information on a need-to-know basis a formal process should be created to grant user access to resources. This can include a user onboarding form and helpdesk tickets from a user's manager requesting changes to a user's access rights. To ensure that access rights are accurate user security groups should be periodically reviewed and update to reflect access requirements. Access to systems and data must be revoked when a user no longer has a valid business need.