AC.L2-3.5.2[a] — The identity of each user is authenticated or verified as a prerequisite to system access.