The Organization’s access to data is dynamic, supporting just-in-time and just-enough principles, and continual risk-based determinations.

The Organization governs access to data using least privilege controls that consider identity, device risk, and other attributes.

The Organization governs access to data by using static access controls.

The Organization data should be protected on devices, in applications, and networks. Organizations should inventory, categorize, and label data, protect data at rest and in transit, and deploy mechanisms for detection data exfiltration.