Spain ENS op.acc.4: Access rights management: deny by default, least privilege, need to know

What does op.acc.4 require?

All access is forbidden unless expressly authorised; privileges are the minimum needed; access follows need to know and responsibility to share; only competent staff grant, change or revoke access, with periodic reviews; a specific remote access policy with express authorisation applies.