Which term is defined as the periodic evaluation of user access rights to ensure they are appropriate and compliant?

Which term is defined as the periodic evaluation of user access rights to ensure they are appropriate and compliant?

• A. Access Review and Certification
• B. Auditing and Reporting
• C. Tools
• D. Digital Identity

Answer: (B)

Periodic evaluation of who has access and confirming that those permissions are still appropriate is a governance activity called Access Review and Certification. It involves managers or resource owners periodically reviewing user entitlements, attesting that each access is still needed and compliant with policy, and certifying or revoking permissions accordingly. This process helps enforce least privilege, prevent entitlement creep, and support regulatory and policy compliance by ensuring that access reflects current roles and needs. Auditing and reporting, while important for visibility and incident response, focuses on recording and analyzing what happened in the system rather than the formal attestations of who should have which access. Tools refers to the software used to manage identities and access, and Digital Identity is the concept of representing a person in digital systems, not the periodic review and certification of rights.

Periodic evaluation of who has access and confirming that those permissions are still appropriate is a governance activity called Access Review and Certification. It involves managers or resource owners periodically reviewing user entitlements, attesting that each access is still needed and compliant with policy, and certifying or revoking permissions accordingly. This process helps enforce least privilege, prevent entitlement creep, and support regulatory and policy compliance by ensuring that access reflects current roles and needs.

Auditing and reporting, while important for visibility and incident response, focuses on recording and analyzing what happened in the system rather than the formal attestations of who should have which access. Tools refers to the software used to manage identities and access, and Digital Identity is the concept of representing a person in digital systems, not the periodic review and certification of rights.