Exam CRISC Topic 6 Question 826 Discussion

The best method to ensure a terminated employee's access to IT systems is revoked upon departure from the
organization is to have the human resources (HR) system automatically revoke system access, which is a
process that involves integrating the HR system with the IT system, and triggering the removal of access
rights for the employee as soon as the termination is recorded in the HR system12.
This method is the best because it provides the most timely, accurate, and consistent way of revoking access,
and reduces the risk of human error, oversight, or delay that may occur in manual or semi-automated
processes12.
This method is also the best because it enhances the security and compliance of the organization, and prevents
the terminated employee from accessing or compromising the IT systems or data after departure12.
The other options are not the best methods, but rather alternative or supplementary methods that may have
some limitations or drawbacks. For example:
Login attempts are reconciled to a list of terminated employees is a method that involves monitoring and
verifying the login activities of the IT systems, and comparing them with a list of terminated employees to
identify and block any unauthorized access attempts34. However, this method is not the best because it is
reactive rather than proactive, and may not prevent the terminated employee from accessing the IT systems
before the reconciliation is done34.
A list of terminated employees is generated for reconciliation against current IT access is a method that
involves creating and maintaining a list of terminated employees, and checking it against the current IT access
rights to identify and remove any access that is no longer needed34. However, this method is not the best
because it is manual and labor-intensive, and may introduce errors or inconsistencies in the list or the access
rights34.
A process to remove employee access during the exit interview is implemented is a method that involves
conducting an exit interview with the terminated employee, and revoking the employee's access to the IT
systems during or immediately after the interview34. However, this method is not the best because it depends
on the availability and cooperation of the terminated employee, and may not cover all the IT systems or
access rights that the employee had34. References =
1: IT Involvement in Employee Termination, A Checklist3
2: Best Practices to Ensure Departing Employees Retain No Access5
3: User Termination Best Practices - IT Security - Spiceworks2
4: IT Security for Employee Termination - Policies, Checklists, Templates - Endsight1