What it asks for. This control asks organisations to manage the full life cycle of user, administrator and service accounts, from creation through to removal. It includes keeping an inventory of accounts, using unique credentials and disabling accounts that are no longer needed.
In practice. Good practice is an account inventory tied to the HR joiner, mover and leaver process so that access is created and revoked automatically. Administrative work is done from separate privileged accounts, passwords are unique and stored in a vault, and dormant accounts are disabled after a defined period of inactivity. Auditors expect account listings, leaver reconciliation reports, evidence of periodic reviews and documentation of service account ownership.
Common gaps. Service accounts and shared accounts are frequently unowned, never rotated and over privileged. Leaver processes often miss contractors and accounts in SaaS applications that are not connected to central identity.