← GLBA · Safeguards Rule (16 CFR 314)
314.4(c)(1) — Access controls on customer information
Requirement
Technical and, as appropriate, physical access controls authenticate and permit access only to authorised users, and limit each user's access to the customer information they need to perform their duties; access is reviewed periodically.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| ISO 27001 | A.5.18 | Access rights review | access-review access-control |
| PCI DSS 4.0.1 | 7.2 | Access granted by least privilege and reviewed every six months | access-control access-review |
| HIPAA | 164.308(a)(4)(ii)(C) | Access establishment and modification (A) | access-review access-control |
| SOC 2 | CC6.3 | Access modification and removal | access-control access-review |
| GDPR | Art.29 | Processing under the authority of the controller | access-control |
| CCPA/CPRA | 1798.100(e) & 1798.150 | Reasonable security procedures | access-control |
| SOC 2 | CC6.2 | Registration and authorisation of new users | access-control |
| ISO 27001 | A.5.3 | Segregation of duties | access-control |