# Access Control - The institution shall limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). - The institution shall limit system access to the types of transactions and functions that authorized users are permitted to execute (role-based access control). - The institution shall have a procedure for removal of access rights (termination) for all departing or resigning personnel, both employees and contractors/third parties. This procedure shall coordinate management decisions with the system administrator/personnel who is responsible for executing system access termination. - In case of malicious activity done by the employee, or contractor (third-party employee), access rights shall be immediately revoked according to the incident response procedure.