Access lifecycle management is the process of granting, changing, reviewing, and removing a person’s access to systems and data over time. It applies throughout an account’s life, from onboarding through role changes and eventual departure, and helps ensure permissions match current duties.
In cyber security, outdated access can expose information or leave unnecessary privileged capabilities in place. A transfer or promotion should trigger a review of existing permissions, including access inherited through groups, followed by removal or documented justification for anything no longer needed. Regular authorization reviews can catch stale access that transition processes miss. These controls support least privilege and help organizations maintain evidence of who approved and changed access.