Control A.6.5Responsibilities after termination or change of employment
Information security responsibilities and duties that remain valid after termination or change of employment must be defined, enforced and communicated to relevant personnel and other interested parties.
Some obligations outlast the relationship: confidentiality, intellectual property, and in some cases restrictions on the use of what the person learned. This control requires those to be identified, communicated and enforced.
The communication element is best done at two points — at the start, when the terms are agreed under A.6.2, and again at the end, when a departure conversation makes them concrete. An obligation signed three years ago and never mentioned again is legally intact and practically forgotten.
The enforcement element is the one organisations rarely plan. An obligation that has never been enforced in any case tells departing people what it is worth, and it is at the point of a contested departure — the one where the obligations matter most — that the absence of any precedent is felt.
How to put this in place
Duties and access should end or change with the role. Without a defined leaver and mover routine, former staff keep access and obligations are forgotten, which is a common audit finding.
- Define the steps for leavers and movers, covering staff, contractors and supplier personnel.
- Add a reminder of continuing confidentiality duties to the exit routine.
- Remove or adjust access on the last day of the role, driven by HR dates.
- Return equipment and keep a record of each step.
- Match access removal dates against HR leaving dates every quarter.
Evidence an auditor usually looks for: leaver and mover checklists, evidence of the confidentiality reminder, and access removal dates matched to HR records for a sample.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists leaver and mover procedure and its records among the documents auditors commonly expect for this control.