...
Thus, for example, a Windows system where the primary user's user’s domain password is sufficient to mount a file server volume and access directories with confidential (Level 1) information would need to be secured as if such information was stored locally.
...
* Note: Visitors are not permitted except under escort.
* An individual's individual’s access to a store of confidential (level 1) information should be via an account assigned for the sole use of that individual. This requirement is not to be interpreted as disallowing access to an encrypted dataset via a shared encryption key.
...