Which guideline outlines the lifecycle step of removing user identities after they are no longer required?

• A. Deactivation Policies
• B. Background Check
• C. Access Standards
• D. Verification of a new employee's history

Answer: (A)

Deactivation Policies govern how identities are removed or disabled when they are no longer needed, capturing the deprovisioning step in the identity lifecycle. They ensure that when someone leaves, changes roles, or no longer requires access, all their credentials are revoked and accounts are disabled or deleted across systems. This helps prevent orphaned accounts and reduces the risk of unauthorized access.

Background checks focus on verifying a person’s history before hiring, not on ongoing lifecycle management. Access standards set criteria for who should have access and under what conditions, but they don’t cover the removal of identities. Verification of a new employee’s history is part of recruitment screening, not the process of deprovisioning.