CISSP Practice Question: A healthcare organization needs to ensure that sensitive patient data is protected…

Correct Answer: A. Implement a centralized identity management system

Explanation (CISSP Manager Logic):

Centralized identity management provides a scalable, automated framework to enforce the principle of least privilege and ensure regulatory compliance. This approach reduces administrative overhead and human error while providing the robust audit trails required in highly regulated sectors like healthcare.

By implementing this solution, you:

• Standardize access controls and policy enforcement across the enterprise.
• Automate provisioning and deprovisioning to eliminate security gaps.
• Improve visibility for compliance audits and incident response.

While the other options are relevant, they fall short because:

• B: Manual processes are inconsistent, slow, and prone to human errors that lead to unauthorized access.
• C: Restricting access to only IT staff creates a functional bottleneck and prevents authorized clinical staff from performing duties.
• D: Reducing training increases organizational risk by leaving users unaware of their security responsibilities.

Think like a manager:

Prioritize automated, centralized controls over manual tasks to ensure consistency, accountability, and cost-effective risk management.