Access to resources and records should be limited to authorized individuals , and accountability for their custody and use should be assigned and maintained .
Only authorized individuals should be able to access the records and resources .