Responsibilities after termination or change of employment
Purpose
Protect the organisation's interests when someone leaves or changes their job or contract.
How to meet this control
In short: Define and enforce security duties that remain after a role ends.
- Step 01Maintain an offboarding checklist that revokes system access, recovers assets and reminds the leaver of ongoing duties, run jointly by HR, IT and the manager
- Step 02State continuing obligations such as confidentiality and non-solicitation in the contract or exit paperwork, with a defined duration
- Step 03Hold an exit interview or sign-off where the departing person formally acknowledges their post-employment security duties
- Step 04Hand over any security roles the leaver held, such as system ownership or approver rights, to a named successor before the last day
- Step 05Trigger access changes automatically from the HR system so role changes and exits drive deprovisioning rather than relying on manual memory
- Step 06Apply the same termination process to contractors and suppliers through their engaging party
Tip: Confidentiality obligations should survive termination; state the duration.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Define which security duties stay in force after someone leaves or changes roles
- ›Capture continuing duties in the employment terms, contract or a confidentiality agreement
- ›Enforce and communicate these ongoing responsibilities to affected staff and interested parties
- ›Treat a change of role as ending the old responsibilities and starting the new ones
- ›Identify the security roles held by anyone leaving or changing jobs and hand them over
- ›Set up a process to tell staff, customers and suppliers about the changes and updated procedures
- ›Apply the same termination or change process to external personnel such as suppliers
- ›Have HR run the termination process with the manager, or the external party under their contract
Audit evidence to keep
- - A completed offboarding checklist for a recent leaver
- - Exit documentation showing the leaver acknowledged continuing obligations
- - The contract or agreement clause defining post-employment duties and duration
- - Access-revocation records timestamped against the termination date
- - Handover records reassigning the leaver security responsibilities
Common mistakes
- - Treating security review as optional when release pressure rises
- - Testing only happy paths and missing abuse cases
- - Not linking production changes to approvals and rollback plans
Owner, cadence, and proof
Assign one accountable owner for A.6.5. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.