Yes. Identity and Access Management (IAM) is part of cybersecurity practices. The existence of access controls makes it harder for outsiders to gain access to resources. It also segments the user community so that one valid user account can’t get access to every resource and only has rights to perform certain actions on the resources to which they have access. This limits the amount of damage that an insider threat can do. An important part of Identity Management is the control of passwords through rotation and complexity enforcement to prevent outsiders from guessing their way in. Abandoned accounts also need to be identified and deleted because they are often the most vulnerable user accounts to hacker takeover.