A current record is kept of the users, or user profiles, authorised to access the information system. This edition numbers the control A.11.10 (it was A.11.9 in 2019). 2019 guidance, not confirmed for this edition: a profile per authorised user holding what the technical access controls need, user ID included.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.