Entity’s Infosec officer reviews and approves the list of people with access to production console annually