Access to business systems is granted from email requests sent by managers, and no process links access to hiring, transfers or terminations. Audits keep finding active accounts belonging to former employees. Which action BEST addresses the root cause?
Select an answer to reveal the explanation.
Short Explanation
If nobody tells the doorman you've left the company, your key card keeps working. Tie access to the HR events that already happen, joining, moving and leaving, and the doors update themselves. The trap is the annual review: it cleans up the mess but doesn't stop you making it.
Full Explanation
The root cause of orphaned accounts is that access changes are disconnected from the authoritative events that should drive them. Integrating provisioning with human resources joiner, mover and leaver processes means a hire triggers role-appropriate access, a transfer triggers removal of the old access and grant of the new, and a termination triggers prompt revocation, ideally through automated workflow from the HR system. Requiring requests to come from a dedicated mailbox improves traceability of requests but still depends on managers remembering to ask for removals, so departures continue to be missed. An annual access review is a valuable detective control, but it finds stale accounts long after they were created and leaves up to a year of exposure; it compensates for the process gap rather than closing it. Locking accounts after inactivity reduces risk from forgotten accounts but does not address a departed employee who keeps using access, nor transfers where users accumulate permissions they still actively use. Exam caveat: the business owner of each system still approves what access roles mean, while HR is the trigger and security designs the control. Operational check: compare termination dates from HR with account disable dates for a sample of leavers and report the elapsed time and any exceptions to management.