What is identity governance designed to do?

• A. Policies and processes to manage digital identities and access rights across systems; reduces risk and ensures compliance.
• B. Managing only physical access to facilities.
• C. Encrypting data at rest across databases.
• D. Maintaining password lists in spreadsheets.

Answer: (A)

Identity governance focuses on controlling and auditing who has access to what across an organization’s digital resources. It covers the lifecycle of identities—from onboarding to changes in roles and offboarding—through policies and processes that determine and enforce appropriate access. By tying permissions to roles and business needs, it promotes least-privilege access, requires regular access reviews, and enforces separation of duties, while providing logs and reports for compliance. This approach reduces risks from overly broad access, orphaned accounts, and noncompliant permissions, and it supports audits and regulatory requirements.

Other activities described are related but different: physical access management deals with entry to facilities, encryption at rest protects data content rather than who can access it, and keeping password lists in spreadsheets is insecure and not a governance practice.