The organization establishes a Discretionary Access Control (DAC) policy that includes or excludes access to the granularity of a single user.
No STIG checks reference this CCI.