After a data loss event, an organization is reviewing its Identity and Access Management (IAM)...

Complete an inventory of who has access to systems.

Create a Role-Based Access Control (RBAC) process to determine what a specific group of users can access.

Create an Attribute-Based Access Control (ABAC) process to assign access to users based on their account attributes and characteristics.

Conduct an assessment and remove all inactive accounts.