CISSP Practice Question: In a large healthcare organization, which foundational approach should the security manager…

Correct Answer: D. Adopting a centralized identity management system

Explanation (CISSP Manager Logic):

A centralized identity management system provides the foundational infrastructure necessary to manage user lifecycles and enforce consistent policies across a large enterprise. This approach creates a single source of truth for access governance, ensuring scalability and compliance before implementing more granular controls.

By adopting a centralized identity management system, you:

• Streamline provisioning and deprovisioning to reduce administrative overhead.
• Ensure consistent enforcement of security policies and HIPAA compliance.
• Create a scalable framework that supports diverse clinical and administrative systems.

While the other options are relevant, they fall short because:

• A: ABAC offers fine-grained control but requires a centralized foundation to be effectively managed at scale.
• B: Auditing is a reactive, detective control rather than a proactive management framework.
• C: Temporary tokens are tactical tools for specific sessions and do not address enterprise governance.

Think like a manager:

Prioritize foundational infrastructure that enables enterprise-wide visibility and control. Strategic security management requires building a robust framework before implementing specialized technical controls.