Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system-generated list of shared/group accounts and associated roles
system audit records
system security plan
other relevant documents or records