Service Accounts and AI Bots in Identity Management
Key Takeaways
The CC outline page says AI bots and automated service accounts are managed through identity lifecycle management, like human users.
Subdomain 3.1 covers roles definition, provisioning, review, and deprovisioning for those accounts.
OpenExamPrep study advice: a flagged anomaly on a service account is a reason to review its permissions and owner.
Source: ISC2 CC Exam Outline page, AI guidance, Domain 3, and subdomain 3.1, checked 2026-10-22.
Service Accounts and Bots
The CC outline page states that AI bots and automated service accounts must be managed through formal identity lifecycle management, as human users are. The lifecycle steps in subdomain 3.1 apply: define the role, provision the account with its permissions, review them, and deprovision when the task ends.
Source: ISC2 CC Exam Outline page, AI guidance, Domain 3, https://www.isc2.org/certifications/cc/cc-certification-exam-outline; and subdomain 3.1 of the outline effective September 1, 2026, checked 2026-10-22.
Anomalies and AI-Assisted Authentication
The outline page says AI can help detect impossible travel or anomalous login patterns. The outline page does not say what an anomaly on a service account means. OpenExamPrep study advice: review that account's permissions and its owner.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 3.1: Roles definition
- 3.1: Provision
- 3.1: Review
- 3.1: Deprovision
- 3.1: Frameworks and tools
Common Traps
A common trap is provisioning before the role is defined. Roles come first; access follows the documented role and is reviewed and removed when it is no longer needed.
Which step does subdomain 3.1 require for a service account when its task ends?
Deprovisioning
Permanent retention of all permissions
Sharing the account with a new team
Skipping review
Service accounts and AI bots go through the same lifecycle steps as human accounts. A bot without a current owner or a documented role is a finding that should be reported and resolved.
Sections you finish are checked off in the contents.