A departing contractor no longer needs access to source code. Which action best enforces the access lifecycle?

1. Change only the public website password policy
2. Remove the contractor's name from an organization chart
3. Wait for the contractor's password to expire
4. Disable accounts and revoke active access tokens promptly