The organization defines the subjects over which the information system will enforce a role-based access control policy.
No STIG checks reference this CCI.