In the context of CMM certification, what is the most important consideration when implementing surface rights & access issues?