When must a leaver's access be removed, and what changes if they leave on bad terms?

Start

HR records a departure, or a sponsor ends an engagement

Every removal starts from the HR record for an employee, or the sponsor register for a non-employee, never from a manager's email. Disabling the directory account ends access to everything on single sign-on and nothing else, so the leaver checklist exists for the systems single sign-on does not reach.

• Then: Is the person leaving now, or on bad terms?

Decision

Is the person leaving now, or on bad terms?

An urgent or hostile leaver is someone leaving at short notice or on bad terms: a dismissal, a resignation with immediate effect, a suspension, or a leaver suspected of misconduct. HR or the line manager makes the decision. If you are unsure, take the urgent route: removing access an hour early costs little.

• Yes, or not sure: HR tells the service desk first, and agrees when the person hears
• No: a planned leaving date: Set the deadline: the end of the last working day

Step

HR tells the service desk first, and agrees when the person hears

HR or the line manager tells the service desk before telling the person, and they agree the time the person will be told. Out of hours, HR calls the on-call service desk number. An agreed code word or ticket type lets the service desk act at once without asking why; the reason stays with HR.

• Then: Disable every account within 60 minutes of the decision

Step

Disable every account within 60 minutes of the decision

Disable the directory account, end every session and token, and call the named administrator of each system with local accounts. Privileged accounts are disabled at once and their sessions ended. The deadline is 60 minutes after the decision by the pack's default, or the moment the person is told if that comes first. Disable; do not delete, because the accounts may be evidence.

• Then: Has the service desk confirmed every account is disabled?

Decision

Has the service desk confirmed every account is disabled?

The service desk confirms to HR that every account on the checklist is disabled, local accounts included. Only then is the person told.

• No, or not known: Delay telling the person; chase the missing removals
• Yes: Tell the person; recover equipment at the meeting

Step

Delay telling the person; chase the missing removals

The person is not told until the service desk confirms every account is disabled. Call the named administrator, then the system owner. If an account cannot be removed, block sign-in at the system's network or single sign-on gateway where possible.

• Then: Has the service desk confirmed every account is disabled? (back to an earlier step)

Step

Tell the person; recover equipment at the meeting

Recover the laptop, phone, badge and tokens at the meeting. In the pack's example the accounts were disabled 35 minutes after the decision and the person was told 25 minutes after that, with the equipment recovered in the room.

• Then: Is misuse suspected?

Decision

Is misuse suspected?

Misuse can be anything from copied files to changes made in a system before the person left. The pack gives this step to the line manager and the Head of Information Security, at once. If there is a real doubt, treat it as suspected: preserving evidence costs nothing, and losing it cannot be undone.

• Yes, or in doubt: Keep accounts and logs unchanged, and report an incident
• No: Did they hold privileged access or know shared credentials?

Step

Keep accounts and logs unchanged, and report an incident

Keep the accounts and their logs exactly as they are, and report it as a security incident through your incident route. Record which accounts were signed in and from where, and export their sign-in logs, before anything is changed. Do not wipe or rebuild a recovered device until the incident manager agrees.

• Then: Did they hold privileged access or know shared credentials?

Step

Set the deadline: the end of the last working day

HR records the last working day, and the contractual end date where it is later. The last working day is the last day at work: it can be earlier than the contractual end date where holiday or garden leave follows, and the deadline follows the last day at work. For a non-employee the sponsor ends the engagement in the sponsor register.

• Then: Open the checklist: a named person for every system

Step

Open the checklist: a named person for every system

Open the leaver checklist with one line for each system the person's profile and non-standard access reach, local accounts included. Assign each local-account line to the named administrator of that system, never to a shared mailbox. In the pack's example a removal sent to a site mailbox went four working days late.

• Then: Disable the directory account and remove local accounts

Step

Disable the directory account and remove local accounts

By the end of the last working day, disable the directory account, end its sessions on every device and remove it from its groups. Convert or delegate the mailbox to the line manager and remove forwarding rules. Each named administrator removes the local accounts in their system, and remote access goes too.

• Then: Did they hold privileged access or know shared credentials?

Decision

Did they hold privileged access or know shared credentials?

Check the privileged account inventory and the vault's access log, not only the profile: privileged access is never in a role profile. In the pack's example a leaver's administrator account was missed while the daily account went on time, and was found 51 working days later. If you cannot tell, take the yes branch and list what they held.

• Yes, or not known: Disable privileged accounts and change what they could read
• No: Recover devices, badges and tokens; change shared codes

Step

Disable privileged accounts and change what they could read

For a planned leaver, every privileged account is disabled by the end of the last working day, at the latest when the daily account is; for an urgent leaver, at once. Every shared, service and break-glass credential the person could read is changed within 1 working day by the pack's default, and they come off the on-call approver list and the safe list the same day.

• Then: Recover devices, badges and tokens; change shared codes

Step

Recover devices, badges and tokens; change shared codes

The same day, recover the laptop, phone, security token, badge and keys, or wipe devices remotely, and disable the badge. Change any shared password, safe code or alarm code the person knew. Close or transfer accounts they held with suppliers or customers on the organisation's behalf, and hand their shared files to the line manager.

• Then: Is every removal confirmed in its system, with a time?

Decision

Is every removal confirmed in its system, with a time?

A removal counts only when it is confirmed in the system: the user list, the audit log or the account's status. A completed directory task says nothing about local accounts, and a closed ticket is not confirmation. Record the time of each confirmed removal on the checklist and in the provisioning log.

• No, or not known: Escalate the missing removal today; it is a late leaver
• Yes: Close the checklist; delete the accounts after 90 days

Outcome

Escalate the missing removal today; it is a late leaver

Call the named administrator, then the system owner, and block sign-in at the gateway where the account cannot be removed. If a supplier cannot remove it in time, record its reason and the system owner raises the removal time against the contract. Every late leaver is raised with the access review as a finding, and a repeated cause goes to the process owner as a process weakness.

Outcome

Close the checklist; delete the accounts after 90 days

Keep the completed checklist, with the time of each removal, as your evidence. Delete removed accounts 90 days after removal by the pack's default, once their data has been dealt with. The month-end reconciliation compares every removal time with the last working day, so a late removal is found even if nobody reports it.