The asset owner shall have policies and procedures related to denying software services interactive login capabilities.