Which guideline would you consult to guide the decision to revoke access due to policy or risk assessment?

• A. Access Standards
• B. Background Check
• C. Verification of a new employee's history
• D. Deactivation Policies

Answer: (D)

Access revocation guidance governs how and when to disable or suspend user access when policy violations or risk are identified. Deactivation policies specify the triggers for revocation (such as policy breaches or risk findings) and lay out the concrete steps to take—disabling credentials, terminating sessions, removing from groups and permissions, and documenting the action. This ensures the process is timely, consistent, and auditable, helping maintain least-privilege access and reducing the chance of unauthorized activity. The other options are more focused on onboarding or screening rather than the ongoing decision to revoke access: general access standards describe who should have access and baseline controls, while background checks and verification of a new employee’s history relate to pre-employment screening, not ongoing deactivation decisions.