Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.6.5Responsibilities after termination or change of employment

What it means in practice

Information security responsibilities and duties that remain valid after termination or change of employment must be defined, enforced and communicated to relevant personnel and other interested parties.

Some obligations outlast the relationship: confidentiality, intellectual property, and in some cases restrictions on the use of what the person learned. This control requires those to be identified, communicated and enforced.

The communication element is best done at two points — at the start, when the terms are agreed under A.6.2, and again at the end, when a departure conversation makes them concrete. An obligation signed three years ago and never mentioned again is legally intact and practically forgotten.

The enforcement element is the one organisations rarely plan. An obligation that has never been enforced in any case tells departing people what it is worth, and it is at the point of a contested departure — the one where the obligations matter most — that the absence of any precedent is felt.

How to put this in place

Duties and access should end or change with the role. Without a defined leaver and mover routine, former staff keep access and obligations are forgotten, which is a common audit finding.

  1. Define the steps for leavers and movers, covering staff, contractors and supplier personnel.
  2. Add a reminder of continuing confidentiality duties to the exit routine.
  3. Remove or adjust access on the last day of the role, driven by HR dates.
  4. Return equipment and keep a record of each step.
  5. Match access removal dates against HR leaving dates every quarter.

Evidence an auditor usually looks for: leaver and mover checklists, evidence of the confidentiality reminder, and access removal dates matched to HR records for a sample.

What is in the packs for this

Each one helps with this requirement.

  • Excel

    Annex A Control Implementation Library

    in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
  • Excel

    Statement of Applicability Template

    in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
  • Excel

    Mandatory ISMS Documentation Checklist

    in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists leaver and mover procedure and its records among the documents auditors commonly expect for this control.
  • PowerPoint

    Tabletop Scenario — Insider Data Exfiltration

    in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck.
  • Word

    Access Control Policy

    in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: Movers and leavers: access removed when the job changes or ends (JML-08, JML-09).
  • Word

    Joiner-Mover-Leaver Operating Procedure

    in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: Mover and leaver steps.
  • Excel

    Leaver Access Removal Checklist

    in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: Leavers and Checklist scope: what remains valid after the person leaves is ended, and assets and shared credentials are recovered or changed.
  • Word

    Privileged Access Request, Elevation & Revocation Procedure

    in Privileged Access ManagementIts Framework References list this control. Supported by: Leavers, movers and suppliers.