Access Control List (ACL) to control PS Reports

PS Gurus,

I have activated Access Control List for a PS Project Profile.

It is working for the respective project and restricting the structural elements by marking them 'red'.

However, the users who do not have access/ have restricted access for that project are still able to see the financial and scheduling data for each project element via all the project reports (i.e. "S_" & "CN or "CJ" reports).

Is this a standard behaviour or I am missing anything here?

If I need to restrict the project reports against each project, what would be the best solution?

Thanks in advance.

Bhushan