What level of Permissions required to manage the CSV files?

[brahma-sanke]

We observed users with basic access also can import CSV files for controls in this plugin.
Is this normal behavior of plugin or any bug?
What level of permissions are required to manage controls options in CSV files in this plugin? We thought only super admins can do this but not