Business requirements of access control

6.6.1.1 Access control policy The control, implementation guidance and other information stated in ISO/IEC 27002:2013, 9.1.1 applies.
6.6.1.2 Access to networks and network services The control, implementation guidance and other information stated in ISO/IEC 27002:2013, 9.1.2 applies

PIPEDA (Personal Information Protection and Electronic Documents Act) - Canada