Which statement best reflects recommended identity management practice?

• A. Identities should be managed by the IT department.
• B. Identities should be managed by people closest to the situation.
• C. Identities should be outsourced to vendors.
• D. Identities should be managed by senior executives.

Answer: (B)

Identities should be managed by the people closest to the situation. This makes sense because the individuals who are closest to the work—the resource owners, department heads, or team leads—understand who needs access, what level of access is appropriate, and for how long. They can grant permissions quickly when a project starts, adjust access as roles evolve, and revoke access promptly when someone changes roles or leaves the organization. While IT provides the system to manage identities and enforce security policies, day-to-day provisioning and deprovisioning work is most effective when driven by those who have direct knowledge of the business needs.

Relying on central IT alone can create bottlenecks and may lack the specific context required to assign correct permissions. Outsourcing identity management to vendors can reduce visibility and control, increasing risk. Having senior executives manage identities generally lacks the hands-on context needed for timely and precise access decisions.