CISSP lens
Pick answers that align business risk, governance intent, and practical control execution.
Why this matters
The best access control model means little if your provisioning and review processes are slow, inconsistent, or ignored. Real world security depends on how access is requested, approved, granted, reviewed, and removed day by day. That is the job of access control administration.
Core concept
Access control administration is everything that happens around the technical enforcement points. It is where identity, process, and tools meet.
Key elements include:
Centralized versus decentralized administration
- Centralized administration: A single team or function manages access policies and provisioning for many systems. This improves consistency and governance but can become a bottleneck.
- Decentralized administration: Business units or local administrators manage access to their own systems. This increases speed and flexibility but risks inconsistent standards and weak oversight.
Most enterprises adopt a hybrid model, centralizing policy and standards while delegating day to day approvals and assignments.
Provisioning workflows
Provisioning is not just account creation. A robust workflow includes:
- Standardized request channels, such as self service portals or tickets
- Clear approval paths, often including both managers and data owners
- Automation that translates approvals into actual changes in directories and applications
Technologies like SCIM and identity governance platforms can synchronize accounts and entitlements across many systems.
De provisioning and termination handling
De provisioning removes access when it is no longer needed. Failure here is one of the most common findings in audits.
Good de provisioning:
- Links directly to HR events such as terminations and role changes
- Disables accounts promptly
- Cleans up residual entitlements, tokens, and access keys
Account types
Access administration handles different account types, each with distinct rules:
- Standard user accounts for employees and contractors
- Privileged accounts for administrators and operators
- Service accounts for applications and integrations
- Guest accounts for short term external users
- Break glass accounts for emergency access when normal authentication fails
Each type needs specific policies for provisioning, review, and monitoring.
Access reviews and certifications
Access reviews ask, "Does this person still need this access". Certifications are the formal attestation of that answer.
Effective access reviews:
- Occur on a sensible schedule, such as quarterly for critical systems
- Provide reviewers with context, such as last login date and business justification
- Focus attention on higher risk entitlements rather than every permission equally
Reviews are a detective and corrective control for privilege creep and segregation of duties violations.
CISSP lens
Domain cross-reference
For CISSP, access control administration ties technical controls to governance.
Key exam themes:
- Centralized administration supports consistent policy enforcement and easier auditing.
- Decentralized administration can be appropriate for diverse or rapidly changing environments but must still follow corporate standards.
- Access reviews, certifications, and role management are part of identity governance, not just operations.
- Break glass accounts require strong monitoring, short term use, and post incident review.
Questions may describe audit findings such as orphaned accounts or incomplete reviews and ask which process improvements are needed.
Real world scenario
An organization with 5,000 employees managed access with email requests and spreadsheets. Every quarter, compliance required a manual user access review. Managers received large spreadsheets of entitlements and approved nearly everything without detailed review.
Audit findings included:
- Dozens of former employees whose accounts remained active in individual applications
- Users with powerful entitlements that no manager could explain
- Inconsistent handling of contractor and vendor accounts
The company implemented an identity governance and administration solution that:
- Connected to the HR system so terminations automatically triggered account disablement
- Centralized entitlement data, so reviews showed clear descriptions and usage information
- Introduced risk based reviews, prioritizing highly privileged or unusual entitlements
- Automated reminders and escalation to ensure reviews were completed on time
Within a year, the number of orphaned accounts dropped sharply, and auditors reported improved evidence of effective access controls.
Common mistakes
Treating access reviews as an annual checkbox exercise instead of a meaningful control.
Relying on manual provisioning with no integration to HR systems, leading to delays and errors.
Leaving break glass accounts unmonitored or with static passwords, creating hidden backdoors.
Ignoring default vendor accounts that remain enabled with known credentials.
Allowing each business unit to define its own processes with no overarching policy or standards.
Actionable checklist
- Decide which access administration tasks will be centralized and which will be delegated, and document the rationale.
- Integrate your identity platform with HR systems to automate provisioning and de provisioning based on hire, move, and terminate events.
- Define account type policies, including who can request and approve each type and what review frequency applies.
- Build or adopt standardized workflows for access requests, with clear approval chains and SLAs.
- Move from enormous annual access reviews to more frequent, smaller, risk based campaigns that managers can handle thoughtfully.
- Lock down, monitor, and regularly test break glass accounts, including after use password changes and detailed activity reviews.
Key takeaways
- Access control administration turns access policies into daily reality through provisioning, changes, and de provisioning.
- Integration with HR systems and automation through standards like SCIM greatly reduce errors and delays.
- Access reviews and certifications are critical governance tools, but only if they are manageable and risk focused.
- Special account types, including privileged and break glass accounts, need well defined policies and strong monitoring.
- A hybrid model that centralizes standards while delegating some administration often provides the best balance of control and flexibility.
Exam-style reflection
Question: An administrator uses a break glass account with domain admin privileges during a critical outage. What should happen after the incident, from an access administration perspective
Answer: All actions taken with the break glass account should be reviewed, and associated logs preserved. The account password should be changed, and the incident should be documented, including why normal access was insufficient. Lessons learned should feed back into provisioning and monitoring so that future emergencies rely less on uncontrolled privileged accounts.
