A third-party vendor has offered to perform user access provisioning and termination.

According to the CRISC Review Manual1, authorizing user access requests is the process of granting or denying access to IT resources based on the user’s role, responsibilities, and business needs. Authorizing user access requests is a key control accountability that should be retained within the organization, as it helps to ensure that the principle of least privilege is applied, and that the access rights are aligned with the organization’s policies, standards, and risk appetite. Authorizing user access requests also helps to prevent unauthorized access, data leakage, fraud, and other potential risks associated with user access provisioning and termination. Therefore, the best control accountability to retain within the organizationwhen a third-party vendor offers to perform user access provisioning and termination is authorizing user access requests. References = CRISC Review Manual1, page 240.