What is the process of periodically validating user access appropriateness called?

• A. Centralized Repository
• B. Reporting and Auditing
• C. User Identities
• D. Access Review

Answer: (D)

Access review is the process of periodically validating whether each user’s access is still appropriate for their current role. It typically involves owners or managers attesting that the permissions granted align with the user’s responsibilities, with any excessive or outdated access revoked or adjusted. This practice supports least-privilege enforcement and regulatory compliance by providing a recurring check on who has access to what.

Centralized repository is where identities and access data are stored, but it’s not the act of reviewing access itself. Reporting and auditing involve generating logs and evidence of what happened, not the ongoing attestation of whether access is appropriate. User identities refer to the accounts themselves, not the governance process that confirms their access levels.