What it asks for. This control expects access to information and other associated assets to be restricted in line with the organisation's topic-specific access control policy. Its purpose is to make sure only authorised users and systems can reach information, preventing unauthorised access.
In practice. Good practice means applying access rules within applications and systems, not only at login, so users see only the information they need. Methods include role-based permissions, restricting access to sensitive data sets, controlling read, write and delete rights, and considering dynamic access management for sensitive information. Auditors expect access rules that link back to policy and evidence that permissions are configured and reviewed.
Common gaps. Typical gaps are broadly shared folders and collaboration spaces, overly permissive default roles in SaaS applications and no review of who can access sensitive data.