Which guideline is primarily concerned with deactivating identities and ensuring they can no longer access systems?

• A. Background Check
• B. Verification of a new employee's history
• C. Access Standards
• D. Deactivation Policies

Answer: (D)

This item tests how offboarding and access revocation are handled to prevent continued access. Deactivation policies lay out the exact steps and timing to disable user accounts, revoke credentials, and remove privileges across systems whenever someone leaves, is terminated, or changes roles. The goal is to ensure there are no active sessions, tokens, or permissions that could be exploited after the person should no longer have access, and to keep entitlement records accurate and auditable.

Background checks and verification of a new employee’s history pertain to screening before hiring, not turning off access after someone leaves. Access standards describe who should have access and under what rules, but they don’t specify the process for turning off access once it’s no longer needed. Deactivation policies directly address the need to deactivate identities and prevent lingering access.