HRS-007 Termination and Access Revocation
Description
Upon termination or role change, all logical access rights are revoked within a defined timeframe. The termination process includes retrieval of physical assets, disabling of authentication credentials, review of ongoing confidentiality obligations and a documented offboarding checklist. Asset return obligations are written into employment and contractor agreements. The same process applies to contractors and third-party personnel. Where an insider risk indicator against an individual is confirmed, that individual's accounts and sessions are disabled within a defined period of the confirmation, independently of any termination or role change.
Rationale
Access that persists after employment ends is a direct path for unauthorised access or data exfiltration, and a time-bound revocation process limits the exposure window and evidences completion. The insider risk clause covers the case the leaver process misses entirely: an individual who is still employed and still in role, against whom something has been confirmed. GOV-027 runs the programme that raises and confirms the indicator; HRS-007 carries the account action that follows and the clock on it.
Applicability (9 profiles)
Framework Mappings (14)
| HRS-05 | Asset returns | full |
| HRS-06 | Employment Termination | full |
| HRS-05 | Asset returns | full |
| HRS-06 | Employment Termination | full |
| HIPAA-164.308.a.3.ii.C | Termination Procedures | full |
| 5.11 | Return of assets | full |
| 6.5 | Responsibilities after termination or change of employment | full |
| NIS2-CIR-10.3 | Termination or Change of Employment Procedures | informative |
| NIS2-CIR-12.5 | Deposit, Return or Deletion of Assets upon Termination of Employment | full |
| AC-2(13) | Account Management | Disable Accounts for High-risk Individuals | full |
| PS-4 | Personnel Termination | full |
| PS-5 | Personnel Transfer | full |
| PS-7 | External Personnel Security | partial |
| CC6.2 | Prior to Issuing System Credentials and Granting System Access | informative |
Evidence (4)
Employment agreement clause or exit declaration confirming ongoing confidentiality obligations and asset return requirements are signed by the employee.
Example: Employment agreement template (legal counsel-approved document), Section on Termination Obligations, referencing: return of all company property, ongoing confidentiality obligations post-employment, and prohibitions on retaining copies of organisational data, signed by a sample of recent hires.
Test: Request the employment agreement template and a signed copy for a sample of three current employees and three recent terminations. Verify: (1) asset return obligation is explicitly stated, (2) ongoing confidentiality requirement post-employment is present, (3) the signed agreement is on file for each sampled individual.
Completed offboarding checklists confirming logical access revocation and physical asset retrieval were completed within the defined timeframe for a sample of terminated personnel.
Example: Offboarding workflow records (ServiceNow / Jira / HRIS offboarding module) for a sample of terminated employees and contractors, showing: termination date, access revocation date and time, asset return confirmation, and completed checklist sign-off.
Test: Request offboarding records for at least five terminations in the last 12 months (including at least one contractor). For each, verify: (1) access revocation occurred within the defined SLA (e.g. same-day for involuntary termination, by last day for voluntary), (2) physical asset return is confirmed, (3) the offboarding checklist is fully completed with a named verifier and date.
IAM system export showing no active accounts belong to terminated employees or contractors.
Example: Active user account export from Okta, Azure AD, or AWS IAM, cross-referenced against the HR termination log, showing no account is active for any individual whose termination date has passed.
Test: Export the list of active user accounts from the IAM system. Cross-reference against the HR list of terminations in the last 12 months. Verify: (1) no terminated employee or contractor has an active login-capable account, (2) any service accounts associated with terminated individuals are also disabled or re-owned, (3) the check is repeatable via a scheduled report or script.
Records of accounts disabled on a confirmed insider risk indicator, showing the elapsed time from confirmation to disablement.
Example: Insider risk account action log 2026, cross-referenced to GOV-027 case records
Test: Request the disablement records for confirmed insider risk indicators. Verify: (1) each confirmation raised in the period resolves to a disablement record, (2) the elapsed time from confirmation to disablement is within the defined period, (3) the disablement covered every account and active session the individual held rather than the primary account alone, (4) re-enablement, where it happened, carries a recorded decision and an approver, (5) where no indicator was confirmed in the period, the disablement path was exercised on a test account and the elapsed time recorded.
Questions (3)
Are all logical access rights revoked within a defined timeframe on termination or role change?
Completed offboarding checklists should show access revocation dates and confirm the SLA was met (typically same-day for involuntary terminations).
What is your defined maximum timeframe for revoking all logical access after an involuntary termination?
Same-day revocation for involuntary terminations is the expected standard. IAM export cross-referenced against the HR termination log is the verification evidence.
Which of the following does your offboarding process cover?
Options run from the most commonly covered to the least. Contractor access is the gap that outlives the engagement, because the trigger for offboarding sits with the engaging team rather than with human resources. The last item runs on its own trigger and does not wait for a termination.