What should happen to a user ID when access is no longer required due to termination or role change?

What should happen to a user ID when access is no longer required due to termination or role change?

• A. Keep the user ID active for 90 days.
• B. Immediately revoke or disable the user ID.
• C. Archive the ID for two years.
• D. Reassign the ID to another user without changing permissions.

Answer: (B)

When access is no longer needed because someone has terminated or moved to a different role, the user ID should be immediately revoked or disabled. This is about removing access promptly to prevent any possibility of unauthorized entry to systems or cardholder data. Delaying deprovisioning creates a window where the former user (or someone who steals their credentials) could still access sensitive information, and it can complicate access reviews and compliance requirements. Keeping the ID active for any period, archiving it without disabling access, or reassigning the ID to someone else without updating permissions all fail to eliminate the risk or ensure appropriate access control. Immediate deactivation ensures that permissions align with the current state of employment and supports a strong, ongoing security posture.

When access is no longer needed because someone has terminated or moved to a different role, the user ID should be immediately revoked or disabled. This is about removing access promptly to prevent any possibility of unauthorized entry to systems or cardholder data. Delaying deprovisioning creates a window where the former user (or someone who steals their credentials) could still access sensitive information, and it can complicate access reviews and compliance requirements.

Keeping the ID active for any period, archiving it without disabling access, or reassigning the ID to someone else without updating permissions all fail to eliminate the risk or ensure appropriate access control. Immediate deactivation ensures that permissions align with the current state of employment and supports a strong, ongoing security posture.