What it asks for. This control expects rules for controlling physical and logical access to information and other associated assets to be established and implemented, based on business and information security requirements. Its purpose is to make sure only authorised access takes place and to prevent unauthorised access to information and assets.
In practice. Good practice is a topic-specific access control policy built on need to know and least privilege, defining how access is requested, approved, reviewed and removed. The rules are reflected in technical configuration across systems, including cloud services. Auditors look for the policy, evidence of approvals, periodic access reviews and timely removal of leavers.
Common gaps. Common gaps are a policy that is not applied consistently across SaaS tools, access that accumulates as people move roles and reviews that are rubber-stamped.