Which guideline specifies the process to disable identities that are no longer needed?

Which guideline specifies the process to disable identities that are no longer needed?

• A. Deactivation Policies
• B. Access Standards
• C. Background Check
• D. Verification of a new employee's history

Answer: (A)

The main idea is managing identities through their lifecycle, specifically the deprovisioning part when access is no longer needed. Deactivation policies lay out exactly how and when to disable or remove an identity’s access—who approves the action, what steps to take (revoking credentials, disabling accounts, revoking tokens, and cutting off app access), and when it should happen (upon termination, role change, project end, or inactivity). They also cover documenting and auditing the process to ensure compliance. Other choices don’t focus on this ongoing process of turning off access: access standards describe what access is allowed, not how to disable it; background checks and verifying a new employee’s history relate to hiring and initial access rather than deprovisioning.

The main idea is managing identities through their lifecycle, specifically the deprovisioning part when access is no longer needed. Deactivation policies lay out exactly how and when to disable or remove an identity’s access—who approves the action, what steps to take (revoking credentials, disabling accounts, revoking tokens, and cutting off app access), and when it should happen (upon termination, role change, project end, or inactivity). They also cover documenting and auditing the process to ensure compliance.

Other choices don’t focus on this ongoing process of turning off access: access standards describe what access is allowed, not how to disable it; background checks and verifying a new employee’s history relate to hiring and initial access rather than deprovisioning.