Access rights are allocated according to the organization’s policy

There is confirmation that data output is accurate and complete

Servers are located in locked rooms to which access is restricted

A record is maintained to track the process from data input to storage