Strategies to Manage Mainframe Accounts and Entitlements Problems

I could say that the companies must be able to ensure and attest that internal controls are effective enough to meet regulatory requirements. In other words, it's not enough to simply protect the network. You have to be able to prove to an auditor that what you're doing is sufficient to protect the network, too. One set of controls that is especially important and required by almost all security-related regulations is the set associated with the administration of user accounts and access rights. In particular, companies need controls that ensure that users and privileges are deleted in a timely manner when they are no longer needed. Failure to do so creates "account clutter" that can expose a company to serious security vulnerabilities and amount to a material compliance failure for SOX and other regulations.

I think most of time users retain unneeded access to resources when they are no longer appropriate. For example, when an employee is promoted or accepts a new job in a different department or division of the same company, that employee is usually given new entitlements. The old ones, however, are often not removed. This problem is exacerbated by a transition period during which the employee needs both the new and old sets of privileges -- making it unclear exactly when the old privileges can be safely deleted.