Establish the rules describing the responsibilities and expected behavior, for security, for individuals requiring access to the system.
No STIG checks reference this CCI.