That's right. You're right that we're not talking so much about hacking, although if there aren't good access controls, that could facilitate hacking as well. Primarily, we're looking at this: Only the people who need access should have access, and they should have access only to the parts of the system they need to access.
