the case study is about crippling a company by telephone thank you

Consider the cases you analyzed last week and the various Access Control policies and mechanisms that have been covered in this week's materials, including the NIST IR7316 document. Which specific Access Control policies and/or mechanisms would you suggest the organization in the case implement? What limitations might this better access control policy have? What company data would be accessible to which employees? What other measures, e.g. encryption, digital signatures, might the companies consider taking? Please make your own suggestions, and feel free to discuss and comment on each other's posts