Which IAM control function is used to evaluate user access against defined KPIs?

Which IAM control function is used to evaluate user access against defined KPIs?

• A. Access Review
• B. Reporting and Auditing
• C. Lifecycle Challenges
• D. Segregation of Duties

Answer: (B)

Evaluating user access against defined KPIs relies on ongoing visibility into access data and how it measures up against those targets. Reporting and auditing provides the tools to collect, aggregate, and analyze access events, permission changes, and approval records, and then compare that information to KPIs. This creates dashboards and audit trails that show whether access controls meet performance targets like on-time recertifications, policy-compliant access rates, or the frequency of privilege violations, supporting governance and compliance. Access reviews are about confirming that current access rights are appropriate, which is important but typically focuses on correctness rather than measuring performance against KPIs. Segregation of Duties is about preventing conflicting permissions and ensuring checks and balances, not about KPI evaluation. Lifecycle management concerns provisioning and deprovisioning processes, not the KPI-focused evaluation of access.

Evaluating user access against defined KPIs relies on ongoing visibility into access data and how it measures up against those targets. Reporting and auditing provides the tools to collect, aggregate, and analyze access events, permission changes, and approval records, and then compare that information to KPIs. This creates dashboards and audit trails that show whether access controls meet performance targets like on-time recertifications, policy-compliant access rates, or the frequency of privilege violations, supporting governance and compliance.

Access reviews are about confirming that current access rights are appropriate, which is important but typically focuses on correctness rather than measuring performance against KPIs. Segregation of Duties is about preventing conflicting permissions and ensuring checks and balances, not about KPI evaluation. Lifecycle management concerns provisioning and deprovisioning processes, not the KPI-focused evaluation of access.