nerdexam
Isaca

CRISC · Question #531

Which of the following is the MOST important key performance indicator (KPI) for monitoring the user access management process?

The correct answer is B. Percentage of accounts disabled within the service level agreement (SLA). For user access management, the most critical KPI is ensuring that accounts are disabled promptly following an event like termination, as per defined SLAs, to prevent unauthorized access.

Submitted by anjalisingh· Apr 18, 2026Risk Response and Reporting

Question

Which of the following is the MOST important key performance indicator (KPI) for monitoring the user access management process?

Options

  • AProportion of end users having more than one account
  • BPercentage of accounts disabled within the service level agreement (SLA)
  • CProportion of privileged to non-privileged accounts
  • DPercentage of accounts that have not been activated

How the community answered

(48 responses)
  • A
    6% (3)
  • B
    75% (36)
  • C
    15% (7)
  • D
    4% (2)

Why each option

For user access management, the most critical KPI is ensuring that accounts are disabled promptly following an event like termination, as per defined SLAs, to prevent unauthorized access.

AProportion of end users having more than one account

While managing multiple accounts per user is a consideration, it doesn't directly measure the effectiveness of timely access removal, which is a higher security priority.

BPercentage of accounts disabled within the service level agreement (SLA)Correct

This KPI directly measures the effectiveness and timeliness of the offboarding process, which is crucial for preventing unauthorized access by former employees or compromised accounts. Failing to disable accounts within the SLA timeframe creates significant security vulnerabilities by leaving dormant or potentially exploitable access open.

CProportion of privileged to non-privileged accounts

The ratio of privileged to non-privileged accounts is an indicator of privilege distribution but not the primary measure of the efficiency and security of the access management process itself.

DPercentage of accounts that have not been activated

The percentage of unactivated accounts might indicate an inefficient provisioning process, but it doesn't represent the most critical security aspect of managing existing user access like timely deactivation.

Concept tested: User access management KPIs

Topics

#Access Management#KPI#Risk Monitoring#Service Level Agreement

Community Discussion

No community discussion yet for this question.

Full CRISC Practice