At what stage of an assessment would an auditor test systems for weaknesses and attempt to defeat existing encryption, passwords and access lists?
Giving each user or group of users only the access they need to do their job is an example of which security principal.