Leaver Access Removal Checklist

Covers every account type, shared credential, token and physical item that must be removed or recovered on exit.

Available soon

Format: Excel
Size: 79 KB
Length: 12 sheets
Version: 2.0
Updated: 1 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

2.01 Oct 2026
Rewritten to the depth of the other CISO Times packs: one row per leaver with the removal deadline JML-09 sets, one row per required removal with its confirmation in the system (JML-14), the full checklist by group, the month's JMM-01 with the results by system, the late removal and what went to the access review, and a signature block.
1.01 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Set the as-at date on the Summary sheet. The EXAMPLE uses 2026-09-30, the month end of its report; use the day you check.
2	When HR records a leaver, or a sponsor ends an engagement, add a row on Leavers: the type (Planned, Urgent, or End date for a non-employee whose recorded end date arrives), the last working day and, for a non-employee, the sponsor (JML-10). For an urgent leaver, enter the time of the decision and the time the person is to be told: the deadline is whichever comes first of [[60]] minutes after the decision and the moment they are told.
3	Add one row on Removal checks for each system the leaver's access must be removed from: always the directory account, and every system in their profile or non-standard access that holds local accounts outside single sign-on. The named removal role shows beside each; the system list is on the Lists sheet.
4	Record the time each removal was made, and mark it confirmed only when you have seen it in the system: the user list, the audit log or the account's status (JML-14). An unconfirmed removal is not complete, however it was requested.
5	Work through the Checklist scope for each leaver: the email, files, shared credentials, devices, badge and supplier accounts. Record recovered items on Leavers. Change every shared credential the person knew the same day.
6	Read the Summary: JMM-01, the late removals by system, and the urgent leavers. Raise every late leaver with the access review coordinator as a finding (P07 AR-08), and a repeated cause as a process weakness (P07 AR-11), as JML-15 sets.
7	Keep the completed checklist as evidence for the period your records policy sets, and at least until the next audit. Delete removed accounts [[90]] days after removal, once their data has been dealt with.
8	To clear the EXAMPLE, delete the contents of the Example column and of every yellow column on Leavers and Removal checks; keep the white formula columns.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026. Nine leavers: 6 planned, 1 urgent (L-05, removed 35 minutes after the decision and before being told), and 2 non-employees whose accounts expired at their recorded end date. L-02, a warehouse team leader, lost the directory account on time; the local warehouse system account went four working days late. The warehouse system's log shows no sign-in to the account after the last working day, and the badge was recovered on the day. The warehouse system removal task went to a shared site mailbox, not to the named administrator.

Adapting for a small organisation: one person may do every line; keep the confirmation in the system, and have a second person look over the month's checklist. A short list of local-account systems is still a list: write it down.

Adapting for a regulated entity (NIS2, DORA): the completed checklist shows that access is removed on termination and that assets are returned or made unable to reach the systems (Implementing Regulation (EU) 2024/2690 Annex 11.2 and 12.5; Delegated Regulation (EU) 2024/1774 Article 19(b)(iii)). Keep it with the HR record of the leaving date.

Adapting where a service provider runs your IT: the provider makes the removals the service desk would make, within the times above, written into the contract. The confirmation is still checked by someone in your organisation, from the system, never from the provider's ticket alone.

Leavers

One row per leaver, from the HR record or the sponsor register (JML-01). Yellow columns are inputs; white columns calculate from the Removal checks sheet. A leaver is on time only when every removal was confirmed by the deadline.

Example	Leaver ID	Employee or non-employee	Leaver type	Role profile	Sponsor (non-employee)	Last working day	Decision (urgent leaver)	Told (urgent leaver)	Removal deadline (calc)	Removals needed (calc)	Removals confirmed (calc)	Removals late (calc)	Last removal (calc)	Minutes from decision (calc)	Equipment, badges and tokens recovered	Result, JMM-01 (calc)	Note
EXAMPLE	L-01	Employee	Planned	RP-01 Warehouse operative		4 Sep 2026			4 Sep 2026	2	2	0	4 Sep 2026			On time
EXAMPLE	L-02	Employee	Planned	RP-02 Warehouse team leader		11 Sep 2026			11 Sep 2026	3	3	1	17 Sep 2026		Badge, on the last working day	Late	The warehouse system removal task went to a shared site mailbox, not to the named administrator.
EXAMPLE	L-03	Employee	Planned	RP-03 Customer service agent		11 Sep 2026			11 Sep 2026	1	1	0	11 Sep 2026			On time
EXAMPLE	L-04	Employee	Planned	RP-01 Warehouse operative		18 Sep 2026			18 Sep 2026	2	2	0	18 Sep 2026			On time
EXAMPLE	L-05	Employee	Urgent	RP-06 Sales account manager		23 Sep 2026	23 Sep 2026	23 Sep 2026	23 Sep 2026	1	1	0	23 Sep 2026	35	Laptop, Phone, Badge	On time
EXAMPLE	L-06	Agency worker	End date	RP-01 Warehouse operative	Warehouse 1 manager	18 Sep 2026			18 Sep 2026	2	2	0	18 Sep 2026			On time	The directory account expired automatically at the end date recorded at joining.
EXAMPLE	L-07	Contractor	End date	None: base profile and non-standard access	Head of Logistics	25 Sep 2026			25 Sep 2026	1	1	0	25 Sep 2026			On time	The project ended on its recorded date without anyone telling HR or the service desk. The account expired automatically at the end of the day.
EXAMPLE	L-08	Employee	Planned	RP-01 Warehouse operative		25 Sep 2026			25 Sep 2026	2	2	0	25 Sep 2026			On time
EXAMPLE	L-09	Employee	Planned	RP-07 Transport planner		30 Sep 2026			30 Sep 2026	4	4	0	30 Sep 2026			On time

Removal checks

One row per system each leaver's access must be removed from: the directory account, and every system with local accounts in their access (JML-09, JML-12). A removal counts once it is confirmed in the system (JML-14).

Example	Leaver ID	System ID	System (calc)	Sign-in (calc)	Named removal role (calc)	Deadline (calc)	Removed at	Confirmed in the system	Completed by	Evidence reference	Result (calc)	Working days late (calc)
EXAMPLE	L-01	SYS-07	Directory and single sign-on (staff accounts)	Single sign-on	IT service desk	4 Sep 2026	4 Sep 2026	Yes	IT service desk	[[ticket and system log reference]]	On time
EXAMPLE	L-01	SYS-02	Warehouse management system	Local accounts	Warehouse systems administrator	4 Sep 2026	4 Sep 2026	Yes	Warehouse systems administrator	[[ticket and system log reference]]	On time
EXAMPLE	L-02	SYS-07	Directory and single sign-on (staff accounts)	Single sign-on	IT service desk	11 Sep 2026	11 Sep 2026	Yes	IT service desk	[[ticket and system log reference]]	On time
EXAMPLE	L-02	SYS-02	Warehouse management system	Local accounts	Warehouse systems administrator	11 Sep 2026	17 Sep 2026	Yes	Warehouse systems administrator	[[ticket and system log reference]]	Late	4
EXAMPLE	L-02	SYS-08	Pallet network booking portal (P06 SUP-009)	Local accounts	Transport office administrator	11 Sep 2026	11 Sep 2026	Yes	Transport office administrator	[[ticket and system log reference]]	On time
EXAMPLE	L-03	SYS-07	Directory and single sign-on (staff accounts)	Single sign-on	IT service desk	11 Sep 2026	11 Sep 2026	Yes	IT service desk	[[ticket and system log reference]]	On time
EXAMPLE	L-04	SYS-07	Directory and single sign-on (staff accounts)	Single sign-on	IT service desk	18 Sep 2026	18 Sep 2026	Yes	IT service desk	[[ticket and system log reference]]	On time
EXAMPLE	L-04	SYS-02	Warehouse management system	Local accounts	Warehouse systems administrator	18 Sep 2026	18 Sep 2026	Yes	Warehouse systems administrator	[[ticket and system log reference]]	On time
EXAMPLE	L-05	SYS-07	Directory and single sign-on (staff accounts)	Single sign-on	IT service desk	23 Sep 2026	23 Sep 2026	Yes	IT service desk	[[ticket and system log reference]]	On time
EXAMPLE	L-06	SYS-07	Directory and single sign-on (staff accounts)	Single sign-on	IT service desk	18 Sep 2026	18 Sep 2026	Yes	IT service desk	[[ticket and system log reference]]	On time
EXAMPLE	L-06	SYS-02	Warehouse management system	Local accounts	Warehouse systems administrator	18 Sep 2026	18 Sep 2026	Yes	Warehouse systems administrator	[[ticket and system log reference]]	On time
EXAMPLE	L-07	SYS-07	Directory and single sign-on (staff accounts)	Single sign-on	IT service desk	25 Sep 2026	25 Sep 2026	Yes	IT service desk	[[ticket and system log reference]]	On time
EXAMPLE	L-08	SYS-07	Directory and single sign-on (staff accounts)	Single sign-on	IT service desk	25 Sep 2026	25 Sep 2026	Yes	IT service desk	[[ticket and system log reference]]	On time
EXAMPLE	L-08	SYS-02	Warehouse management system	Local accounts	Warehouse systems administrator	25 Sep 2026	25 Sep 2026	Yes	Warehouse systems administrator	[[ticket and system log reference]]	On time
EXAMPLE	L-09	SYS-07	Directory and single sign-on (staff accounts)	Single sign-on	IT service desk	30 Sep 2026	30 Sep 2026	Yes	IT service desk	[[ticket and system log reference]]	On time
EXAMPLE	L-09	SYS-02	Warehouse management system	Local accounts	Warehouse systems administrator	30 Sep 2026	30 Sep 2026	Yes	Warehouse systems administrator	[[ticket and system log reference]]	On time
EXAMPLE	L-09	SYS-08	Pallet network booking portal (P06 SUP-009)	Local accounts	Transport office administrator	30 Sep 2026	30 Sep 2026	Yes	Transport office administrator	[[ticket and system log reference]]	On time
EXAMPLE	L-09	SYS-10	Freight rate comparison site	Local accounts	Transport office administrator	30 Sep 2026	30 Sep 2026	Yes	Transport office administrator	[[ticket and system log reference]]	On time

Checklist scope

What the checklist covers

Every line to work through for a leaver, grouped as the Access Control Policy groups them (JML-09). Lines for systems with local accounts come from the system list; add one for every system that holds local accounts outside single sign-on (JML-12).

Checklist lines

Group	Line	Applies when	Who does it	By when	Evidence to keep
Directory account and single sign-on	Disable the directory account	Every leaver	IT service desk	By the end of the last working day; an urgent leaver within [[60]] minutes of the decision and before they are told	Directory audit log entry, with the time
Directory account and single sign-on	End the person's sessions on every device	Every leaver	IT service desk	By the end of the last working day; an urgent leaver within [[60]] minutes of the decision and before they are told	Sign-in log showing no session after the removal
Directory account and single sign-on	Remove the account from every group, so no role reaches a connected system	Every leaver	IT service desk	By the end of the last working day; an urgent leaver within [[60]] minutes of the decision and before they are told	Group membership export after the change
Local accounts outside single sign-on	Remove the local account in Warehouse management system (SYS-02)	The leaver's profile or a non-standard right includes the system	Warehouse systems administrator	By the end of the last working day; an urgent leaver within [[60]] minutes of the decision and before they are told	The system's user list or audit log after the change
Local accounts outside single sign-on	Remove the local account in Pallet network booking portal (P06 SUP-009) (SYS-08)	The leaver's profile or a non-standard right includes the system	Transport office administrator	By the end of the last working day; an urgent leaver within [[60]] minutes of the decision and before they are told	The system's user list or audit log after the change
Local accounts outside single sign-on	Remove the local account in Freight rate comparison site (SYS-10)	The leaver's profile or a non-standard right includes the system	Transport office administrator	By the end of the last working day; an urgent leaver within [[60]] minutes of the decision and before they are told	The system's user list or audit log after the change
Local accounts outside single sign-on	[[Add one line for each further system that holds local accounts (JML-12)]]	[[The leaver held an account there]]	System administrator	By the end of the last working day; an urgent leaver within [[60]] minutes of the decision and before they are told	[[The system's own record]]
Remote access	Remove remote access, the virtual desktop and any device certificate	The leaver had remote access	IT service desk	By the end of the last working day; an urgent leaver within [[60]] minutes of the decision and before they are told	Remote access user list after the change
Email and files	Convert the mailbox, or delegate it to the line manager	Every leaver with a mailbox	IT service desk	The same day as the access removal	Mailbox settings after the change, and the line manager's confirmation
Email and files	Remove every forwarding rule the person set up	Every leaver with a mailbox	IT service desk	The same day as the access removal	Mail rule report after the change
Email and files	Hand over shared files to the line manager	The leaver owned shared files	Line manager	The same day as the access removal	Line manager's confirmation
Shared credentials	Change every shared password, safe code or alarm code the person knew	The leaver knew a shared credential	IT service desk	The same day as the access removal	Change record for each credential
Tokens and devices	Recover the laptop and phone, or wipe them remotely	Every leaver issued a device	IT service desk	The same day as the access removal	Asset register entry, or the remote wipe log
Tokens and devices	Recover any security token and removable media	The leaver was issued one	IT service desk	The same day as the access removal	Asset register entry
Physical access	Recover the badge and keys, and disable the badge	Every leaver with a badge or keys	IT service desk	The same day as the access removal	Access control system entry
Supplier and customer accounts	Close or transfer accounts the person held with suppliers or customers on the organisation's behalf	The leaver held such an account	Line manager	By the end of the last working day; an urgent leaver within [[60]] minutes of the decision and before they are told	The supplier's or customer's confirmation
Privileged access	Remove privileged access as the Privileged Access Standard sets	The leaver held privileged access	As the privileged access pack sets	As the privileged access pack sets	As the privileged access pack sets
After the leaver has gone	Delete the removed accounts once their data has been dealt with	Every removed account	IT service desk	[[90]] days after removal (JML-09)	Deletion record

The leaver events and their deadlines

Event	Source	Trigger	Deadline	Rules
LE-04 Leaver	HR record or sponsor register	HR records the last working day, or the sponsor ends the engagement	All access removed by the end of the last working day; equipment and tokens recovered the same day	JML-09
LE-05 Urgent or hostile leaver	HR record	HR or the line manager decides the person leaves now, or is suspended	All access removed within [[60]] minutes of the decision, and before the person is told	JML-09
LE-06 Non-employee end date	Sponsor register	The recorded end date arrives, or the sponsor ends the engagement early	The account expires automatically at the end of the end date; an early end is a leaver the same day	JML-10

The groups, as the policy lists them

Group	What it includes
Directory account and single sign-on	Disable the account, end sessions on every device, remove from groups
Local accounts outside single sign-on	One named line per system that holds local accounts (JML-12)
Remote access	Remote access, virtual desktop and any device certificate
Email and files	Mailbox converted or delegated to the line manager; forwarding rules removed; shared files handed over
Shared credentials	Any shared password, safe code or alarm code the person knew is changed
Tokens and devices	Laptop, phone, security token and removable media recovered, or wiped remotely
Physical access	Badge and keys recovered, badge disabled
Supplier and customer accounts	Accounts the person held with suppliers or customers on the organisation's behalf
Privileged access	As the Privileged Access Standard sets

Privileged access, including administrator, emergency and service accounts, is removed as the Privileged Access Standard sets (JML-16); the line above only reminds you to do it.

Summary

Summary and sign-off

The month's leavers and removals, calculated from Leavers and Removal checks. JMM-01 goes to the Leaver Timeliness & Orphaned Account Report as it stands here.

Settings

Setting	Value			Note
As-at date	30 Sep 2026			EXAMPLE: the month end. A removal still open after its deadline shows as overdue.
Minutes allowed for an urgent leaver (JML-09)	60			[[60]] in the Access Control Policy.

This month

Figure	Result	What it counts
JMM-01 Leavers removed on time	8 of 9	Leavers whose last working day fell in the period and whose access was removed from every system, local accounts included, within JML-09's time, out of all such leavers.
Leavers removed late	1	Any removal confirmed after the deadline, or not confirmed by it. Each is raised with the access review coordinator (P07 AR-08).
Leavers still open	0	Deadline not yet reached and a removal not yet confirmed.
Urgent leavers	1	Removed within [[60]] minutes of the decision and before being told, or late.
Removals checked	18	Rows on Removal checks.
Removals late	1	By system in the table below.
Removals not confirmed in the system	0	A removal counts only once it is seen in the system (JML-14).

Removals by system

System	Removals	On time	Late	Named removal role
SYS-07 Directory and single sign-on (staff accounts)	9	9	0	IT service desk
SYS-06 Email and office apps (P06 SUP-005)	0	0	0	IT service desk
SYS-01 ERP (hosted; P06 SUP-004)	0	0	0	ERP provider (P06 SUP-004), by service desk ticket, for roles inside the ERP
SYS-02 Warehouse management system	6	5	1	Warehouse systems administrator
SYS-05 Shared finance drive	0	0	0	IT service desk (directory groups)
SYS-08 Pallet network booking portal (P06 SUP-009)	2	2	0	Transport office administrator
SYS-10 Freight rate comparison site	1	1	0	Transport office administrator

The late removal: what happened (EXAMPLE)

Item	Detail
Leaver	L-02, warehouse team leader, last working day 11 Sep 2026
Late system	SYS-02 Warehouse management system, removed 2026-09-17 at 10:20, four working days late
Was it used?	The warehouse system's log shows no sign-in to the account after the last working day, and the badge was recovered on the day.
Cause	The warehouse system removal task went to a shared site mailbox, not to the named administrator.
What was done	Recorded against P07 PW-01 (HR Director, due 30 Nov 2026), which stays open. The leaver checklist now sends the warehouse system line to the named administrator.

Sent to the access review (P07)

Item	Raised as			Detail
Leaver L-02	Repeat of P07 PW-01			Warehouse system account removed four working days late.

Sign-off

Role	Name	Date	Signature or approval reference
Checklist completed by (IT service desk)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Reviewed by (Head of Information Security)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Accepted by (Process owner)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]

Rules

Rules this workbook applies

The rules come from the Access Control Policy and keep their IDs across the pack. Change a rule there, never here: this sheet quotes it.

Rule	Requirement	Where this workbook applies it
JML-01	Every employee's account is created, changed, suspended and removed only from an event in the HR record, and every non-employee's only from the sponsor register. No account is created on a manager's request alone, and no account exists without a record in one or the other.	Leavers: every leaver comes from the HR record or, for a non-employee, the sponsor register.
JML-09	A leaver's access is removed from every system, including local accounts outside single sign-on, by the end of their last working day. For an urgent leaver it is removed within [[60]] minutes of the decision, and before the person is told. Equipment, badges, tokens and shared credentials are recovered or changed the same day, using the leaver checklist. Removed accounts are deleted after [[90]] days, once their data has been dealt with.	Leavers: the deadline and the result; Removal checks: every system, local accounts included; Checklist scope: what is recovered and changed.
JML-10	Every non-employee has a sponsor and an end date, recorded in the sponsor register before the account is created and no more than [[12]] months after the start. The account expires automatically at the end of that date. The sponsor is reminded [[10]] working days before, and only the sponsor can extend it, with a new end date. An engagement that ends early is a leaver the same day.	Leavers: a non-employee's account expires at the end of the recorded end date (type End date).
JML-12	Every system that holds accounts, including software bought with a card or signed up to with a work email address, is in the system inventory with an owner. Discovery runs every [[3]] months from card and expense spend, single sign-on and app-consent logs and the supplier register. Each system found is connected to single sign-on, or kept with its local accounts listed on the leaver checklist and in the reconciliation, or closed.	Removal checks and Checklist scope: one line for each system with local accounts outside single sign-on.
JML-14	Every grant, change, suspension and removal is recorded in the access provisioning log with its request reference, the approvers, who made the change and when it was completed. A removal is recorded as complete only when it is confirmed in the system.	Removal checks: a removal counts only when confirmed in the system, with the evidence reference.
JML-15	Within [[3]] working days of each month end, every in-scope system's accounts are reconciled with the HR record and the sponsor register. An orphaned account is disabled within [[1]] working day of being found. Every late leaver, mover with residual access and orphaned account is raised as a finding with the access review coordinator (P07 AR-08), and a pattern goes to the process owner as a process weakness (P07 AR-11).	Summary: late leavers raised with the access review coordinator; a pattern is a process weakness.
JML-16	Privileged access, including administrator, emergency ("break-glass") and service accounts, follows the Privileged Access Standard of the Privileged Access Management pack. This pack sets no rule for it and puts no privileged access in a role profile. A leaver or mover who holds privileged access is handled by this pack's process, with the privileged steps the Privileged Access Standard sets.	Checklist scope: privileged access removed as the Privileged Access Standard sets.

Lists

SysID	SysName	SysSignIn	SysRemovedBy	LeaverType	Kind	YesNo
SYS-07	Directory and single sign-on (staff accounts)	Single sign-on	IT service desk	Planned	Employee	Yes
SYS-06	Email and office apps (P06 SUP-005)	Single sign-on	IT service desk	Urgent	Agency worker	No
SYS-01	ERP (hosted; P06 SUP-004)	Single sign-on	ERP provider (P06 SUP-004), by service desk ticket, for roles inside the ERP	End date	Contractor
SYS-02	Warehouse management system	Local accounts	Warehouse systems administrator		Consultant
SYS-05	Shared finance drive	Single sign-on	IT service desk (directory groups)		Supplier's staff
SYS-08	Pallet network booking portal (P06 SUP-009)	Local accounts	Transport office administrator
SYS-10	Freight rate comparison site	Local accounts	Transport office administrator

Columns A to D are the system list: each system in lifecycle scope, how people sign in, and the named role that removes its accounts. Yellow rows: add your own.

Definitions

Definitions

Term	Meaning in this workbook
Leaver	A person whose employment or engagement ends. All their access is removed, and everything they hold is recovered.
Urgent leaver	A leaver who leaves at short notice or on bad terms: a dismissal, a resignation with immediate effect, a suspension, or a leaver suspected of misconduct. Also called a hostile leaver.
Last working day	The leaver's last day at work, from the HR record. It can be earlier than the contractual end date, for example where holiday or garden leave follows.
Leaver type	Planned: the HR record gives the last working day in advance. Urgent: the person leaves now, or is suspended. End date: a non-employee's recorded end date arrives and the account expires by itself.
Non-employee	Anyone who is given an account but is not on the payroll: a contractor, an agency worker, a consultant or a supplier's staff.
Sponsor	The employee accountable for a non-employee's access: normally the line manager of the team they work for. Confirms the end date, and ends or extends the access.
Single sign-on	Signing in to many systems with one directory account. Disabling that account stops access to every system connected to it.
Local account	An account a system holds itself, outside single sign-on. Disabling the directory account does not touch it; it must be removed in the system.
Remove	To disable an account or withdraw an access right so it can no longer be used. A removed account is deleted later, once its data has been dealt with.
Removal deadline	The end of the last working day; for an urgent leaver, [[60]] minutes after the decision or the moment the person is told, whichever comes first (JML-09).
Confirmed in the system	Seen in the system itself, from its user list, audit log or the account's status, not from the ticket that asked for the removal (JML-14).
On time	Every removal for the leaver confirmed by the deadline. JMM-01 counts leavers, not removals.
Working days late	Working days, Monday to Friday, from the deadline's day to the day of the removal.
Orphaned account	An account that matches no current person in the HR record or the sponsor register, or a shared account with no named owner. P07 calls it an orphan account.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026. Delete before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.18 — Access rights	Removal checks: access removed on leaving, from every system, and confirmed
ISO/IEC 27001:2022	Annex A 6.5 — Responsibilities after termination or change of employment	Leavers and Checklist scope: what remains valid after the person leaves is ended, and assets and shared credentials are recovered or changed
NIST CSF 2.0	PR.AA-01 — “Identities and credentials for authorized users, services, and hardware are managed by the organization”	The whole checklist: identities and credentials of people who leave are ended
NIS2 — Directive (EU) 2022/2555	Article 21(2)(i) — “human resources security, access control policies and asset management”	The checklist as part of access control and human resources security
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 11.2 — access rights are provided, modified, removed and documented under the access control policy: assigned and revoked on need-to-know, least privilege and separation of duties; “modified accordingly upon termination or change of employment”; authorised by the relevant persons; third-party access limited in scope and in duration; a register of access rights granted; logging of the management of access rights; and review at planned intervals	Removal checks: access rights removed upon termination of employment, and the removal documented
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 12.5 — assets in the custody of personnel are deposited, returned or deleted upon termination of employment, and this is documented; where that is not possible, the assets can no longer access the entity's network and information systems	Checklist scope and Leavers: assets returned or deleted on termination, and documented
DORA — Delegated Regulation (EU) 2024/1774	Article 19(b)(iii) — staff return all ICT assets and tangible information assets that belong to the financial entity upon termination of employment	Checklist scope: ICT and information assets returned on termination (financial entities)
DORA — Delegated Regulation (EU) 2024/1774	Article 21(e) — account management: roles for granting, reviewing and revoking access; privileged access on a need-to-use basis; removal without undue delay; review at least every six months for systems supporting critical or important functions and at least yearly for others	Removal checks: access rights withdrawn without undue delay on termination

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.