Description Role-based access control is implemented and access is provisioned on a least-privilege basis. Context Weight 1 Control area HR security, access control & asset management MOSCOW Must Control Framework NIS2