Requirement
"Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements."[1]
Explanation
As part of the information security policy define access control policies to limit access to systems and information. Examples include defining password length and reset requirements.
