Comprehensive and Detailed Step-by-Step Explanation:
Failure torevoke access upon terminationposes the greatest security risk, as ex-employees could still access sensitive data or systems.
* No Policy to Revoke Access (Correct Answer - A)
* A terminated employee retaining access can lead todata breaches or insider threats.
* Example:A former employee misuses active credentials to access financial systems.
* Lack of Security Awareness Training (Incorrect - B)
* Important but does not pose an immediate security risk like an active ex-employee account.
* No NDAs (Incorrect - C)
* Protects intellectual property but is not as critical as system access.
* No Access Revocation for Role Changes (Incorrect - D)
* Still a concern, but ex-employees with active access are ahigherrisk.
References:
* ISACA CISA Review Manual
* NIST 800-53 (Access Control)