Which statement best describes the relationship between identity management and risk management?

• A. Identity management is unrelated to risk management.
• B. Identity management is the sole part of risk management.
• C. Identity management is another form of risk management.
• D. Identity management replaces risk management.

Answer: (C)

Managing identities and access is a crucial control within risk management. Identity management covers authenticating users, authorizing their actions, provisioning and deprovisioning accounts, and enforcing policies like least privilege and multifactor authentication. By tightly controlling who can reach which resources and auditing those accesses, you reduce the risk of unauthorized access, data breaches, and insider threats. Risk management is the broader process of identifying and mitigating all information security risks, and identity management is a major component of that process. It is not unrelated, not the only part, and it does not replace risk management; rather, it is one form of risk management—one of the key controls that help lower overall risk.