The organization defines the objects over which the information system will enforce a role-based access control policy.
No STIG checks reference this CCI.