Which process is used for removing access when users leave the organization?

• A. Performance Metrics
• B. Security Policies
• C. Termination
• D. Access Administration Cost

Answer: (C)

Deprovisioning (offboarding) is the process used to remove access when a user leaves the organization. The formal term for executing that removal is termination, which ensures that all credentials are revoked and accounts are disabled across every system, app, and service the person had access to. This includes revoking tokens, disabling directory accounts (like in the IdP or Active Directory), terminating VPN and email access, and coordinating with asset return and role reassignment as needed. Doing this promptly reduces the risk of data exposure or unauthorized activity after departure and supports the principle of least privilege. Other options describe measurements, rules, or costs related to IAM—these don’t by themselves carry out the actual removal of access.