Access management is responsible for implementing policies defined in which process?

Service Portfolio Management governs which services are offered and their investment lifecycle; it does not define access control or security policies.

Information Security Management is responsible for defining, maintaining, and communicating security policies - including who is authorized to access which services and data. Access Management then operationalizes those policies by granting, modifying, and revoking access rights to ensure only authorized users can use services.

Change Management controls the lifecycle of changes to IT infrastructure and services; it does not author or own information security access policies.

Problem Management focuses on identifying and eliminating root causes of incidents; it has no role in defining or enforcing access control policies.