A recent audit of a company's identity management system shows that 30% of active accounts belong to people no longer with the firm. Which of the following should be performed to help avoid this…

Question

Options

• AAutomatically disable accounts that have not been utilized for at least 10 days.
• BUtilize automated provisioning and de-provisioning processes where possible.
• CRequest that employees provide a list of systems that they have access to prior to leaving the firm.
• DPerform regular user account review / revalidation process.
• EImplement a process where new account creations require management approval.

• A
  8% (2)
• B
  79% (19)
• C
  4% (1)
• E
  8% (2)

Explanation

The core problem is that accounts are not being disabled when employees leave. Automated de-provisioning (B) ensures that when HR marks an employee as terminated, accounts are disabled immediately without manual intervention - eliminating the gap. Regular account revalidation (D) acts as a safety net, periodically confirming that all active accounts still belong to current employees. Option A is too aggressive - 10 days of inactivity is normal for vacations, leave, etc. Option C is unreliable since employees may not accurately self-report access. Option E addresses new account creation, not the removal of stale accounts.

No community discussion yet for this question.