What it asks for. This control expects the full life cycle of identities to be managed. Its purpose is to allow unique identification of individuals and systems accessing information, so access rights can be assigned appropriately.
In practice. Good practice means each person and, where relevant, each system has a unique identity, identities are created only after approval, and they are updated or disabled promptly when people change role or leave. Shared identities are allowed only where justified and controlled. Auditors look for joiner, mover and leaver processes, links between HR records and identity systems, and evidence that dormant identities are removed.
Common gaps. Common gaps are orphaned accounts, slow disabling of leavers, unmanaged service and non-human identities and identities in SaaS tools outside central management. Identity records are also seldom reconciled against HR data.