Identity, Access, and Data Protection Governance
Identity, Access, and Data Protection Governance
This domain tests whether identity and data controls are governed processes with owners and evidence, not just technology deployed. Expect questions on least privilege, joiner-mover-leaver, privileged access, access recertification, and data classification tied to handling rules.
Access governance
- Least privilege and separation of duties are design requirements; RBAC scales role assignment, ABAC refines it with attributes such as department, location, and data sensitivity.
- The joiner-mover-leaver process is the highest-yield control: access granted on day one, adjusted on transfer, revoked on the last working day. Integration failures here create orphaned and excessive accounts.
- Access recertification should be risk-based: quarterly for privileged and regulated data access, annual for standard. Reviewers must see actual usage, otherwise certification becomes rubber-stamping.
- Privileged access management vaults credentials, brokers sessions, and records them; MFA is mandatory for administrative and remote access.
- Non-human identities - service accounts, API keys, pipeline tokens - need owners, rotation, and inventory. They are the most commonly ungoverned identity class.
Data protection governance
Classify data (public, internal, confidential, restricted) and attach handling rules per class: storage location, encryption, sharing, retention, disposal. DLP, tokenisation, and encryption with managed keys enforce the rules; key management is the control that makes encryption meaningful.
Worked example
A quarterly recertification finds 300 active accounts belonging to leavers. Root cause analysis shows the HR system does not feed the identity provider, so terminations depend on manager emails. Remediation: integrate HR as the authoritative source, automate disablement on termination date, add a monthly orphaned-account report, and re-certify the affected privileged roles immediately. Reasoning: the finding is a symptom; the governance failure is the missing authoritative identity source and the absence of automated deprovisioning evidence.
Traps that cost marks
- Accepting recertification campaigns where reviewers approve everything without usage data.
- Treating MFA rollout as complete identity governance; authorisation and lifecycle remain.
- Forgetting service and machine identities in access reviews.
- Classifying data without publishing corresponding handling rules.
- Allowing break-glass accounts without monitoring, rotation, and post-use review.