The organization must establish and follow a formal procedure for granting authorization to personnel. An authorization must include, at a minimum:

• A structured authorization interview to assess the suitability for the requested access
• Before authorization is granted, the authorization authority must have no information that gives reasonable grounds to doubt that the person is security-fit. The decision and its basis must be documented.