A centralised identity system allows secure access to all applications with one login
Sekit's SSO and federation standard, one of the topic-specific policies A.5.1 expects, requires business applications to authenticate through the central identity provider under documented exception criteria.
Routing sign-in through a central identity provider gives A.5.15's access rules one place to be enforced consistently, rather than scattered across every application's own login system.
Requiring business applications to sign in through the central identity provider is what makes every account traceable to a known person, the mapping A.5.16 asks for.