Sharing how we approached Annex A access control, because I over-thought it at first. We started from the risk, not the control: who can reach what, and what actually goes wrong if the wrong person does. That turned a vague “implement access control” into three concrete decisions: joiner/leaver, privileged accounts, and review cadence. We wrote those down, pointed each at the evidence that proves it happens, and stopped there. No enterprise IAM project. What did other people include or deliberately leave out?
This is the right instinct: proportionate to the risk, not gold-plated. Two things auditors tend to probe on access control. First, the leaver path. Access that outlives the person is one of the most common findings, so make sure your evidence shows removal actually happened, not just that a policy says it should. Second, privileged accounts: they want to see the list is current and reviewed, not that it exists once. If your review cadence is written down and you can show the last one happened, you’re in good shape.