Which term describes the overall strategy for managing user identities and access within an organization?

• A. Risk Assessment
• B. IAM Program
• C. Business Objectives
• D. Security ACL

Answer: (B)

The overall approach to managing user identities and access across an organization is best described by an IAM program. This term captures the coordinated strategy that brings together governance, policies, processes, and technology to securely handle identity lifecycles, authentication, authorization, and access reviews at scale. An IAM program defines how people gain and lose access, who approves that access, how it’s monitored, and how it stays compliant with regulations, across all systems and apps. It includes components like identity provisioning and deprovisioning, role-based or attribute-based access control, single sign-on, multi-factor authentication, password policies, and ongoing auditing.

Other terms refer to specific aspects rather than the whole strategy. A risk assessment looks at potential threats and vulnerabilities to inform security decisions, but it doesn’t by itself establish the enterprise-wide process for managing identities and access. Business objectives describe organizational aims, not the mechanisms for controlling who can access what. A Security ACL is a concrete access-control list used to enforce permissions for particular resources, not the overarching framework that governs identity and access across the organization.