Which statement best describes policy coverage for identity terminations and cancellations?

• A. Policies should cover only termination
• B. Policies should cover both cancellation and termination with prompt revocation
• C. Policies should cover cancellation only
• D. Policies should rely on user self-service to revoke access

Answer: (B)

Coverage should address both termination and cancellation, with access revoked promptly across all systems. When someone leaves the organization, termination deprovisions the user so they can’t log in anymore. If a service or license is canceled, any remaining credentials or tokens that could grant access to that service must be revoked as well. Prompt revocation means these deprovisioning actions happen within a defined, quick timeframe to prevent lingering or unauthorized access. Relying on user self-service isn’t enough because it can introduce delays and gaps in security. By covering both events and enforcing rapid revocation, the policy ensures comprehensive protection and consistent enforcement.