Identity and Access Management (IAM) · Topic 4 of 4
Identity and Access Provisioning Lifecycle
Provisioning and deprovisioning accounts, role changes, access reviews, privilege escalation controls, service accounts and privileged access management.
- 3 min
- Joiner, mover, leaver: grant, adjust, remove.
- Remove old access at role change; review periodically.
- Deprovision promptly; never reuse identifiers.
What it is
Identities and access change constantly as people join, move and leave and as systems are added and retired. The provisioning lifecycle makes sure access is granted correctly, adjusted when roles change, reviewed regularly and removed promptly.
How it works
Lifecycle stages
| Stage | Key controls |
|---|---|
| Provisioning | Access based on role and approved request; least privilege; unique identifiers |
| Role definition and transition | Remove access from the old role when adding the new one |
| Account access review | Managers or data owners recertify access regularly, for users, systems and services |
| Deprovisioning | Disable access promptly at departure; immediately for hostile terminations |
| Identifier retirement | Never reuse identifiers, so a new user cannot inherit an old user's rights |
Reusing a departed employee's user ID can hand a new hire the old mailbox, group memberships and history. Retire identifiers permanently and issue unique ones.
Privileged access
| Control | Purpose |
|---|---|
| Privileged access management (PAM) | Vault privileged credentials, check them out, record sessions |
| Just-in-time elevation | Grant admin rights only when needed, for a limited time |
| Separate admin accounts | Admin tasks use a different account from daily email and web use |
| Break-glass accounts | Emergency access when normal systems fail, with dual-person checkout, alerts and reset after use |
| Privilege escalation controls | Managed sudo, approval workflows, monitoring of elevation |
Service accounts
Service accounts run applications and integrations. They often have broad, long-lived rights and passwords hard-coded in scripts, which makes rotation hard. Good management:
- Inventory every service account with an owner.
- Grant least privilege; deny interactive logon where possible.
- Store credentials in a secrets manager so applications retrieve them; then rotate.
- Prefer managed identities or short-lived credentials over static passwords.
Contractors and temporary access
Grant only the rights the task needs, with an expiry date matching the end of the engagement. Do not add contractors to broad administrator groups and rely on someone remembering to remove them.
Automation
Connect identity management to HR as the authoritative source so joiners, movers and leavers trigger provisioning changes automatically. Automation reduces delays and forgotten accounts.
Reviews that work
Reviews should be risk-based (privileged and sensitive access more often), done by people who understand the access, and should result in actual removals. Reviews where managers approve everything are a rubber stamp; fix the process at the source (role changes) as well.
How the exam asks about this
- "A new hire inherits a departed employee's rights through a reused ID." Retire identifiers permanently and issue unique ones.
- "50 service accounts have non-expiring passwords hard-coded in scripts." Move credentials to a secrets manager, then rotate.
- "Contractor needs elevated rights for one week." Grant only the needed rights with an expiry date.
What to remember for the exam
- Joiner, mover, leaver: grant, adjust, remove.
- Remove old access at role change; review periodically.
- Deprovision promptly; never reuse identifiers.
- PAM, just-in-time access, separate admin accounts and break-glass procedures for privileged access.
- Service accounts need owners, least privilege and managed credentials.
Delayed deprovisioning is a common cause of breaches. Former employees and contractors with active accounts are a direct risk.
Common mistakes
Disabling the account but leaving its group memberships for the next user of the same ID.
Exempting service accounts from rotation instead of fixing hard-coded credentials.
Granting permanent admin rights for temporary tasks.
Check yourself
What prevents a new employee from inheriting an old employee's rights through an identifier?
Retiring identifiers permanently and never reusing them.
What is a break-glass account?
An emergency privileged account used when normal access fails, with strict controls such as dual checkout, alerts and reset after use.
How should hard-coded service account passwords be fixed?
Move them into a secrets manager that applications query, then rotate them.
Topic 4 of 4 in Identity and Access Management (IAM)
Test yourself on Identity and Access Management (IAM)
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.