What it asks for. Organisations should define and run processes for granting, changing and revoking access rights based on roles and least privilege. The control also covers strong authentication, including multi-factor authentication for remote, externally exposed and administrative access.
In practice. Effective programmes use role based access with documented approval workflows, centralise authentication through a single identity provider and enforce multi-factor authentication broadly, starting with administrators, remote access and internet facing applications. Access is recertified periodically by managers or data owners, and revocation on role change is automated. Evidence includes access request and approval records, MFA coverage reports, role definitions and completed access reviews.
Common gaps. MFA gaps often remain for legacy protocols, break glass accounts and third party portals. Access reviews tend to become rubber stamping exercises, and privileges accumulate as staff move between roles.