| 💼 A.9.1 Business requirements of access control | 2 | | | |
| 💼 A.9.1.1 Access control policy | | | | |
| 💼 A.9.1.2 Access to networks and network services | | 17 | 18 | |
| 💼 A.9.2 User access management | 6 | | | |
| 💼 A.9.2.1 User registration and de-registration | | 1 | 1 | |
| 💼 A.9.2.2 User access provisioning | | 4 | 4 | |
| 💼 A.9.2.3 Management of privileged access rights | | 3 | 4 | |
| 💼 A.9.2.4 Management of secret authentication information of users | | 8 | 10 | |
| 💼 A.9.2.5 Review of user access rights | | 1 | 1 | |
| 💼 A.9.2.6 Removal or adjustment of access rights | | | | |
| 💼 A.9.3 User responsibilities | 1 | | | |
| 💼 A.9.3.1 Use of secret authentication information | | 3 | 3 | |
| 💼 A.9.4 System and application access control | 5 | | | |
| 💼 A.9.4.1 Information access restriction | | 19 | 20 | |
| 💼 A.9.4.2 Secure log-on procedures | | | | |
| 💼 A.9.4.3 Password management system | | 1 | 1 | |
| 💼 A.9.4.4 Use of privileged utility programs | | | | |
| 💼 A.9.4.5 Access control to program source code | | | | |