CC6.3 - Based on Authorization, Access to Data is Controlled

CC6.3 requires that an organization only permits access to data after verifying that the user has appropriate authorization. Controls must be implemented to enforce these permissions and prevent unauthorized viewing, modification, or disclosure of