CRISC · Question #531
Which of the following is the MOST important key performance indicator (KPI) for monitoring the user access management process?
The correct answer is B. Percentage of accounts disabled within the service level agreement (SLA). For user access management, the most critical KPI is ensuring that accounts are disabled promptly following an event like termination, as per defined SLAs, to prevent unauthorized access.
Question
Which of the following is the MOST important key performance indicator (KPI) for monitoring the user access management process?
Options
- AProportion of end users having more than one account
- BPercentage of accounts disabled within the service level agreement (SLA)
- CProportion of privileged to non-privileged accounts
- DPercentage of accounts that have not been activated
How the community answered
(48 responses)- A6% (3)
- B75% (36)
- C15% (7)
- D4% (2)
Why each option
For user access management, the most critical KPI is ensuring that accounts are disabled promptly following an event like termination, as per defined SLAs, to prevent unauthorized access.
While managing multiple accounts per user is a consideration, it doesn't directly measure the effectiveness of timely access removal, which is a higher security priority.
This KPI directly measures the effectiveness and timeliness of the offboarding process, which is crucial for preventing unauthorized access by former employees or compromised accounts. Failing to disable accounts within the SLA timeframe creates significant security vulnerabilities by leaving dormant or potentially exploitable access open.
The ratio of privileged to non-privileged accounts is an indicator of privilege distribution but not the primary measure of the efficiency and security of the access management process itself.
The percentage of unactivated accounts might indicate an inefficient provisioning process, but it doesn't represent the most critical security aspect of managing existing user access like timely deactivation.
Concept tested: User access management KPIs
Topics
Community Discussion
No community discussion yet for this question.