Departing employees often keep system access for weeks because HR, legal and operations run their processes without involving the security program. What should the information security manager do to BEST address this?
Select an answer to reveal the explanation.
Short Explanation
Security that sits in its own room is like a goalkeeper who never talks to the defenders. You build regular working ties with HR, legal and operations so security gets baked into their processes, and you don't try to run HR yourself.
Full Explanation
Many security outcomes depend on processes owned by other functions. Access removal, for example, relies on HR notifying departures promptly, legal defining obligations and operations executing changes. The program succeeds when its objectives are integrated into those processes, which requires regular coordination: agreed handoffs, shared objectives and joint ownership of points where security and business processes meet. This approach respects each function's ownership while closing the gap that leaves accounts active. Taking over onboarding and offboarding would move HR responsibilities into the security team, which lacks the authority and context for those processes and would create new handoff problems. Issuing a policy directive without engagement imposes requirements on functions whose processes the security team does not understand and tends to produce minimal compliance rather than integration. Reporting the functions to internal audit escalates a coordination problem into a blame exercise, damaging relationships the program depends on without designing a solution. Exam caveat: policy and audit both have a place, but alignment through collaboration comes first. Operational check: confirm a documented leaver workflow with a defined trigger from HR, a target time for access removal and a metric reviewed jointly.