2-2 Access Control Access control guidelines are the following: Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). Limit system access to the types of transactions and functions that authorized users are permitted to execute. Control the flow of Postal Service information in accordance with approved authorizations. Implement separation of duties of individuals to reduce the risk of malevolent activities without collusion. Employ the principle of least privilege, including for specific security functions and privileged accounts. Use non-privileged accounts or roles when accessing non-security functions. Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. Limit the number of allowed unsuccessful logon attempts. Provide privacy and security notices consistent with applicable Postal Service information rules. Use session lock with pattern-hiding displays to prevent access and viewing of data after periods of inactivity. Automatically terminate a user session after a defined condition (e.g., maximum period of inactivity, time-of-day restrictions). Monitor and control remote access sessions. Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. Route remote access via managed access control points. Authorize remote execution of privileged commands and remote access to security-relevant information. Authorize wireless access prior to allowing such connections. Protect wireless access using authentication and encryption. Control connection of mobile devices. Encrypt Postal Service information on mobile devices and mobile computing platforms. Verify and control/limit connections to and use of external systems. Limit use of organizational portable storage devices on external systems.