Mechanisms exist to utilize a formal user registration and de-registration process that governs the assignment of access rights.
Does the organization utilize a formal user registration and de-registration process that governs the assignment of access rights?