Provisioning is the process of creating user accounts and equipping them with the appropriate access rights. The counterpart is deprovisioning: deactivating accounts and revoking permissions. Automated provisioning through an identity management system reduces errors and speeds up onboarding. Access rights are derived from the employee’s role (role-based provisioning). ISO 27001 Annex A.5.16 requires regulated identity management. You should ensure that provisioning and deprovisioning are fully documented and traceable, as auditors pay particularly close attention to this area.