Which term refers to the information security discipline concerned with user and device access to an organization's resources?

Which term refers to the information security discipline concerned with user and device access to an organization's resources?

• A. Critical Risk Domains (CRD)
• B. Identity and Access Management (IAM)
• C. Identity
• D. Access

Answer: (A)

Identity and Access Management (IAM) is the information security practice that governs who can access what resources, using the right devices, and under what conditions. It combines verifying who someone or something is (authentication) with deciding what they’re allowed to do (authorization) and tracking what happens (auditing). IAM covers creating and managing user identities, provisioning and deprovisioning access across systems, enforcing access control policies, and using technologies like multi-factor authentication, single sign-on, and role-based access control to enforce permissions consistently. Critical Risk Domains isn’t a standard term for this discipline; it’s more about risk categorization and doesn’t describe the governance framework for access. Identity by itself describes who a user is, not how their access is controlled. Access refers to the act of using resources, not the overarching management of identities and permissions.

Identity and Access Management (IAM) is the information security practice that governs who can access what resources, using the right devices, and under what conditions. It combines verifying who someone or something is (authentication) with deciding what they’re allowed to do (authorization) and tracking what happens (auditing). IAM covers creating and managing user identities, provisioning and deprovisioning access across systems, enforcing access control policies, and using technologies like multi-factor authentication, single sign-on, and role-based access control to enforce permissions consistently.

Critical Risk Domains isn’t a standard term for this discipline; it’s more about risk categorization and doesn’t describe the governance framework for access. Identity by itself describes who a user is, not how their access is controlled. Access refers to the act of using resources, not the overarching management of identities and permissions.