| 💼 A.9.1 Business requirements of access control | 2 | 27 | 67 | | no data |
| 　💼 A.9.1.1 Access control policy | | | | | no data |
| 　💼 A.9.1.2 Access to networks and network services | | 27 | 67 | | no data |
| 💼 A.9.2 User access management | 6 | 18 | 28 | | no data |
| 　💼 A.9.2.1 User registration and de-registration | | 1 | 1 | | no data |
| 　💼 A.9.2.2 User access provisioning | | 6 | 6 | | no data |
| 　💼 A.9.2.3 Management of privileged access rights | | 3 | 12 | | no data |
| 　💼 A.9.2.4 Management of secret authentication information of users | | 10 | 12 | | no data |
| 　💼 A.9.2.5 Review of user access rights | | 1 | 1 | | no data |
| 　💼 A.9.2.6 Removal or adjustment of access rights | | | | | no data |
| 💼 A.9.3 User responsibilities | 1 | 4 | 4 | | no data |
| 　💼 A.9.3.1 Use of secret authentication information | | 4 | 4 | | no data |
| 💼 A.9.4 System and application access control | 5 | 51 | 95 | | no data |
| 　💼 A.9.4.1 Information access restriction | | 49 | 92 | | no data |
| 　💼 A.9.4.2 Secure log-on procedures | | | 1 | | no data |
| 　💼 A.9.4.3 Password management system | | 2 | 2 | | no data |
| 　💼 A.9.4.4 Use of privileged utility programs | | | | | no data |
| 　💼 A.9.4.5 Access control to program source code | | | | | no data |