Research question
How can a growing company measure the administrative workload behind timely access removal?
What authoritative sources establish
NIST's Cybersecurity Framework 2.0 organizes cybersecurity outcomes around governance and risk management, and CISA recommends promptly removing departing employees' access. The practical workload spans an identity inventory, system owners, confirmations, and unresolved exceptions.
Operational analysis
Track departures, systems assigned per person, removal confirmations, shared-account exceptions, elapsed time, and reviewer escalations. A complete HR status without system confirmation should remain open in the operations queue.
Staffing boundary
Support staff can maintain inventories, trigger approved checklists, and collect confirmations. System owners retain authority to revoke privileged access, investigate anomalies, and accept exceptions.
Conclusion
Track departures, systems assigned per person, removal confirmations, shared-account exceptions, elapsed time, and reviewer escalations. A complete HR status without system confirmation should remain open in the operations queue. This evidence supports a capacity decision only when the queue recurs and a named owner reviews exceptions.