An audit finds that an employee terminated two weeks ago still has active VPN and SaaS accounts, and the help desk learned of the departure only through a later email. Which process change BEST ensures access is removed when people leave?
Select an answer to reveal the explanation.
Short Explanation
When you leave accounts active after someone walks out, you've let them keep the office keys. Hooking deprovisioning to HR's termination event means the keys get collected the moment they leave. An annual review would catch it - eleven months too late.
Full Explanation
Deprovisioning is the controlled removal of access when a person's relationship with the organization ends or their role changes. The weakness in this scenario is process: IT learned of the termination late through an informal channel. Making the HR system's termination record the authoritative trigger, ideally with automated workflows that disable directory, VPN, and federated SaaS access at the effective time, removes the delay and ensures nothing depends on someone remembering to send an email. Having departing employees change their own passwords leaves the accounts active and under the control of the very person whose access should end. An annual access review is a valuable detective control, but at a yearly cadence it would allow access to persist for months; it supplements, not replaces, timely deprovisioning. Shortening password expiration does not disable accounts, and a user who still knows the current password can simply change it before expiry, so stale access remains. Exam caveat: deprovisioning should include tokens, API keys, and shared credentials the person knew, not only interactive accounts. Operational check: sample recent terminations, compare their effective dates with account disable timestamps across directory and SaaS logs, and investigate any gap.