Who is assigned the responsibility for administering user accounts, including additions, deletions, and modifications?

• A. The finance department
• B. The information security management
• C. External vendors only
• D. The marketing team

Answer: (B)

Managing user accounts is a security governance task. The information security management group is responsible for defining and enforcing the policy for provisioning, modifying, and deprovisioning accounts, ensuring that each user has appropriate access, that changes are authorized, and that access is revoked promptly when someone leaves or changes roles. This centralized responsibility guarantees consistent application of least-privilege principles, proper auditing, and accountability across all systems. The other groups mentioned—the finance team, external vendors, and the marketing team—do not typically own or enforce access-control policies, so they aren’t the appropriate assignee for administering user accounts.