Which guideline addresses the removal of identities that are no longer needed?

Which guideline addresses the removal of identities that are no longer needed?

• A. Deactivation Policies
• B. Access Standards
• C. Verification of a new employee's history
• D. Background Check

Answer: (A)

The main idea here is deprovisioning identities when they are no longer needed. Deactivation policies define how and when user accounts, access rights, and sessions are disabled or removed as part of offboarding, role changes, or contract termination, so that former users can no longer reach systems. This timely removal reduces the risk of unauthorized access from lingering or orphaned accounts and helps keep access aligned with current needs. The other options focus on granting or vetting access during hiring—access standards set rules for granting access, while verification of a new employee’s history and background checks are pre-employment steps—not on removing identities after they’re no longer needed.

The main idea here is deprovisioning identities when they are no longer needed. Deactivation policies define how and when user accounts, access rights, and sessions are disabled or removed as part of offboarding, role changes, or contract termination, so that former users can no longer reach systems. This timely removal reduces the risk of unauthorized access from lingering or orphaned accounts and helps keep access aligned with current needs. The other options focus on granting or vetting access during hiring—access standards set rules for granting access, while verification of a new employee’s history and background checks are pre-employment steps—not on removing identities after they’re no longer needed.