Unauthorized or inappropriate access to core systems

Control

Documented user access management process (add, change, delete users from systems), including periodic access reviews