Any file that your application accesses must have an access control entry (ACE) in the ACL that grants, at minimum, read access to the ASP.NET process account or impersonated identity.
ACLs are configured on the directory and the file inherits the setting.