What it asks for. This category expects access to physical and logical assets to be limited to authorised users, services and hardware, and managed in proportion to the assessed risk of unauthorised access. It covers identity and credential lifecycle, authentication, identity proofing, access permissions and physical access.
In practice. Good practice is a single authoritative identity source, joiner, mover and leaver processes tied to HR records, and phishing-resistant multi-factor authentication for remote, privileged and high-risk access. Permissions follow least privilege and separation of duties, privileged accounts are managed and monitored, and service accounts and machine identities have owners. Access reviews are performed on a schedule with documented outcomes. Auditors will expect identity governance reports, MFA coverage figures, privileged access records, recertification evidence and physical access logs.
Common gaps. Common weaknesses are orphaned accounts after people leave, unmanaged service and API credentials, and MFA gaps on legacy systems. Access reviews often become rubber-stamping exercises with little real scrutiny.