This standard calls for a systematic approach to conducting controls in order to make information available only to those who need to have access to it, and to allow information to be changed only by those who have permission to make changes; it also sets forth that documents must have security classifications.