Question

An IS auditor reviewing an organization's identity and access management program finds that access is granted individually to each user based on the specific request submitted by their manager. As the workforce has grown, the auditor observes that many users with the same job function have inconsistent access rights, and access reviews take excessive time. Which control approach should the auditor recommend to BEST address this situation?

Accepted Answer

Implement role-based access control (RBAC) that maps entitlements to defined job functions

Answer

Require managers to re-approve every individual access request on a quarterly basis

Answer

Enforce stronger password complexity and multifactor authentication for all users

Answer

Deploy a single sign-on solution to consolidate authentication across applications