Access controls can be digital and physical in nature, e.g. permission restrictions on user accounts as well as limitations on who can access certain physical locations (aligned with Annex A.11 Physical and Environment Security). The policy should take into account: