Remote contractors receive municipal accounts from an emailed spreadsheet with no identity proofing. What registration practice should replace that process?
Select an answer to reveal the explanation.
Short Explanation
Emailing a spreadsheet of new logins is not onboarding—it is mailing house keys to a vague address. Register people properly and proof who they are before the account exists. Weak file passwords, proofing after a breach, or free-for-all usernames skip the foundation of identity.
Full Explanation
Establishing identity for remote contractors requires formal registration and identity proofing against authoritative sources before accounts and credentials are created. Proofing—sponsored enrollment, government ID or equivalent trusted evidence, and documented verification—prevents impersonation and fraudulent municipal accounts. Only after the subject is established should credentials be issued under least privilege and lifecycle tracking.
Keeping spreadsheet emailing but encrypting the file with a trivial password like “password1” dresses a broken process in weak cryptography and still skips proofing. Creating accounts first and proofing only after the first security incident accepts preventable impersonation risk as normal. Allowing contractors to pick any free username with no sponsor or verification invites collisions, spoofing of real staff identities, and orphan accounts with no accountable owner.
Exam caveat: registration and proofing precede credential issuance in IAM assurance models; convenience provisioning is not identity establishment. Operational check: replace spreadsheet provisioning with a sponsored registration workflow, require proofing before account creation, assign accountable owners, and audit contractor accounts for proofing evidence and expiry.