Which statement best aligns identity management budgeting with organizational risk?

• A. Budgeting should be driven by risk analysis.
• B. Budgeting should be based on the number of users.
• C. Budgeting should be determined by executive preference.
• D. Budgeting should be exclusively based on vendor recommendations.

Answer: (A)

Aligning identity management funding with risk means allocating resources where the potential impact of identity-related threats is greatest. By conducting a risk analysis, you identify which roles, systems, and data carry the highest exposure—such as privileged admin access, systems with sensitive data, or surfaces exposed to the internet—and then fund controls to mitigate those risks first. This ensures investments in multi-factor authentication, privileged access management, identity governance, monitoring, and incident response are driven by actual risk, not by how many users you have, executive whim, or vendor recommendations. Budgeting by user count ignores threat potential and scenario-based risk, while relying on preferences or vendor slogans may misalign spending with what’s needed to reduce real risk.