Removing or restricting rights to use an IT Service is the responsibility of which process?

Access Management controls the ability of users to use an IT service, including the removal or restriction of access rights when required - for example, when an employee leaves or changes roles. It implements the policies defined by Information Security Management and ensures only authorized individuals can access services, protecting confidentiality and integrity.

Incident Management focuses on restoring normal service operation as quickly as possible following a disruption; it does not manage user access rights.

Request Fulfillment handles standard service requests submitted by users, such as requests for new access, but does not govern the removal or restriction of rights.

Change Management controls the lifecycle of all changes to IT infrastructure and services, not the administration of user access permissions.