CCSP · Question #112
Who should be involved in review and maintenance of user accounts/access?
The correct answer is A. The user's manager. The user's manager is best suited to regularly review and maintain user accounts and access because they have direct knowledge of the employee's role and necessary permissions.
Question
Who should be involved in review and maintenance of user accounts/access?
Options
- AThe user's manager
- BThe security manager
- CThe accounting department
- DThe incident response team
How the community answered
(23 responses)- A91% (21)
- B4% (1)
- C4% (1)
Why each option
The user's manager is best suited to regularly review and maintain user accounts and access because they have direct knowledge of the employee's role and necessary permissions.
The user's manager possesses the most accurate and up-to-date knowledge of an employee's job responsibilities, required access levels, and current employment status. This insight is critical for ensuring the principle of least privilege is upheld and that access is promptly modified or revoked when roles change or employment terminates.
The security manager defines policies and oversees security but may not have granular knowledge of individual job responsibilities to approve specific access levels.
The accounting department's primary role is financial oversight, not detailed management of IT user access.
The incident response team focuses on addressing security incidents, not routine account review and maintenance.
Concept tested: Access review and account management responsibilities
Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Topics
Community Discussion
No community discussion yet for this question.