5.1 Provide and maintain confidentiality
Business systems should have the ability to restrict access to their data, e.g. through an API-manager.