Section 3(3)(d) in The Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018
(d)plan, develop, maintain the documentation of authorised personnel having access to "Protected System" and the same shall be reviewed at least once a year, or whenever required, or according to the Information Security Management System(ISMS) as suggested in clause(b);