What it asks for. System identifiers must be managed by obtaining authorisation before assigning them, assigning them to the intended individual, group, role, service or device, preventing reuse for a defined period and handling them consistently.
In practice. This means unique, non-reused usernames and identifiers allocated through the identity governance process, naming conventions that distinguish privileged and service accounts, and rules that prevent a former employee's identifier being reassigned to someone else. Auditors look for identifier allocation procedures and evidence that reuse is prevented. Identifiers for devices and workloads deserve the same discipline as those for people.
Common gaps. Identifier reuse can give a new user access intended for a previous holder. Service account naming is often inconsistent, making ownership hard to trace. Duplicate identities across directories also complicate access reviews.