Distribution of reports—Critical output reports should be
produced and maintained in a secure area and distributed in an
authorized manner. The distribution process can be tested by
observation and review of distribution output logs. Access to
online output reports should be restricted. Online access may
be tested through a review of the access rules or by monitoring
user output,