Identity Life Cycle Management: Provisioning, Review, and Deprovisioning

Every user identity in an organization follows a predictable life cycle: it is designed, created, used, reviewed, and eventually removed. Identity life cycle management is the discipline of controlling each of those stages so that every account has an owner, every access right has a reason, and nothing is left behind when a person moves on.

The ISC2 CC exam outline breaks the cycle into four activities. Roles definition decides what access a job function needs before any account exists. Provisioning creates the identity and grants that predefined access when a person joins. Review periodically confirms that the access a person holds still matches the job they do today. Deprovisioning disables or removes access when the person leaves or changes roles.

The reason this matters is simple: most access-related security failures are life cycle failures. An attacker who compromises a forgotten account belonging to a departed contractor does not need to defeat any technical control, because the organization defeated itself by skipping deprovisioning. Likewise, an employee who has changed jobs three times without a review may hold far more access than any single role requires, turning one compromised credential into a much larger breach.

Roles definition is the design stage of the life cycle. Before anyone is hired into a position, the organization defines what that position needs: which systems, which applications, which data, and at what level of permission. The output is a documented role, such as accounts payable clerk or help desk technician, with a standard access profile attached.

Defining roles first enforces the principle of least privilege at the moment access is designed rather than after the fact. If the role only needs to read customer records, the role definition grants read access and nothing more. When a new person later fills that role, they inherit exactly the predefined profile, so there is no ad hoc guessing about what to grant.

Roles definition is a shared responsibility. Managers and data owners understand what the job actually requires, human resources knows the job descriptions, and the security team validates that the resulting profile follows least privilege and does not combine duties that should stay separated. On the exam, remember the ordering: access needs are defined for the role before access is provisioned to the person.

Provisioning is the act of creating a new identity and granting it appropriate access. It typically begins with an authorized request, usually triggered by human resources when a new hire starts or when an existing employee takes on a new role. The identity is proofed, meaning the organization confirms the person is who they claim to be, and then an account is created with a unique identifier.

Uniqueness matters. Every person receives their own account so that every action can be traced back to one individual, a property called accountability. Shared or generic accounts break accountability and are a wrong answer on the exam whenever individual traceability is the goal.

The access granted at provisioning should come straight from the role definition, no more and no less. Granting extra access because the person might need it later is over-provisioning and violates least privilege. If a joiner needs something outside the standard profile, that exception should go through a separate documented approval rather than being quietly bundled into the initial grant.

Provisioning also covers issuing authenticators such as passwords, smart cards, or tokens, and enrolling the user in multifactor authentication where required. The stage ends when the joiner can do their job with the minimum access the role requires.

People do not keep the same job forever. They transfer between departments, get promoted, cover for colleagues, and join temporary projects. Each change tends to add access, and unless someone actively removes the old rights, the person accumulates permissions from every role they have ever held. This accumulation is called privilege creep, and it is the classic risk associated with the mover in the life cycle.

The control that catches privilege creep is the periodic access review, also called recertification or attestation. On a defined schedule, or when a role change occurs, a manager or data owner examines each user's current access and formally confirms, or attests, that every entitlement is still required for the current job. Anything that is no longer needed is revoked.

Reviews should be more frequent for privileged accounts, such as administrator access, because the damage from an unnecessary privileged entitlement is far greater. A review is a detective and corrective activity: it detects access that drifted away from the role definition and corrects it by removing the excess. On the exam, when a scenario describes an employee who changed roles and still has old permissions, the answer is almost always a missing or failed access review, and the fix is to review and revoke.

Deprovisioning removes or disables an identity's access when the person leaves the organization or no longer needs the account. It is the leaver stage of the life cycle, and timeliness is the whole point. Access that outlives the working relationship is pure risk with zero business benefit.

An account that remains active after its owner departs is called an orphaned account. Orphaned accounts are a favorite target for attackers because nobody is watching them: no legitimate user notices strange logins, password resets go unread, and the account often retains meaningful access. A disgruntled former employee with a still-active account is an insider threat that walked out the door with the keys.

Best practice distinguishes disabling from deleting. Disable the account immediately at separation, which blocks all access while preserving the account's data, mailbox, and audit history for investigations and handover. Deletion, if it happens at all, follows later under the organization's retention rules. For involuntary terminations, access should be disabled at or before the moment the person is informed, because the window between notification and revocation is when a resentful insider can do the most damage.

Deprovisioning also includes collecting badges, tokens, and equipment, and removing the person from group memberships, shared mailboxes, and third-party services. Partial deprovisioning that misses a cloud application leaves an orphaned account all the same.

The Joiner-Mover-Leaver model, often shortened to JML, maps the identity life cycle onto the three events that change a person's relationship with the organization. It is a useful mental index for exam questions because every scenario about identity management describes one of these three events.

Work through a scenario. Maya joins a hospital as a billing clerk and is provisioned read and write access to the billing system, matching the role definition. Two years later she moves to the audit team. The mover process grants audit system access and, critically, revokes her billing write access, because auditors must not be able to alter the records they audit. When Maya later resigns, her accounts are disabled on her final day, her badge is collected, and her mailbox is preserved for her successor. At each event the access changed to match the current role, and nothing survived that should not have.

The CC exam expects you to recognize the categories of tools that implement the identity life cycle, not to configure them. Each category answers a different question.

• Directory services store identity information, accounts, groups, and attributes, in a central database that systems across the organization query. A directory is the authoritative list of who exists.
• Identity providers authenticate users and issue assertions of identity to other systems, so applications can trust a central login rather than each keeping its own password store.
• Single sign-on (SSO) lets a user authenticate once and access multiple applications without logging in again. SSO improves the user experience and reduces password fatigue, but it also concentrates risk: protect the SSO credential with multifactor authentication.
• IAM and IGA systems (identity and access management, identity governance and administration) orchestrate the life cycle itself: they automate provisioning workflows, route access requests for approval, run recertification campaigns, and keep an auditable record of who approved what.

Automated provisioning ties these together. When human resources records a new hire, the IAM system creates the accounts, applies the role profile, and later, when human resources records a termination, disables everything in minutes. Automation matters because it removes the human delay that creates orphaned accounts, and it applies role definitions consistently instead of relying on an administrator's memory.