mvp not just that, but a plan that includes a complete record of all access that particular employee has access to. This includes and is not limited to portals located outside of the firm’s control, and such records should be concise and accurate to prevent any data being accessed without permission from the owner.