For AC.L1-b.1.i, do I need a formal list of authorized users?

Yes, maintaining a list of authorized users is a key aspect of AC.L1-b.1.i. This helps ensure system access is limited to approved individuals and aids in account management, such as promptly removing access for terminated employees who handled FCI.