Critical infrastructure compliance: managing access control at the right scale