[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-6-5":3},{"item":4,"lessons":16,"controls":34,"related":57},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-6-5","Annex A 6.5","Responsibilities after termination or change of employment",4,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Security duties that continue after someone leaves or changes role, such as confidentiality obligations, should be defined, enforced and communicated to the person and to other relevant parties. The aim is to protect the organisation's interests during and after the transition.\n\n**In practice.** Leavers and movers go through a documented process owned jointly by HR, line managers and IT. Continuing obligations are written into contracts or NDAs and restated at exit, with a signed acknowledgement where appropriate. Access no longer needed is removed on the leaving or role change date, and equipment and information are returned and checked against an asset record. An auditor will expect exit checklists, signed acknowledgements and evidence that access was revoked on time.\n\n**Common gaps.** Role changes are the usual blind spot: people move teams and keep access from their old job for years. Contractors and temporary staff often bypass the HR process entirely, and continuing obligations are rarely reminded at exit.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26,30],{"slug":19,"title":20,"published_at":21},"piaggio-fined-460k-for-unlawful-employee-email-monitoring-and-delayed-account-deactivation","Piaggio Fined €460K for Unlawful Employee Email Monitoring and Delayed Account Deactivation","2026-08-06T10:20:40.321+00:00",{"slug":23,"title":24,"published_at":25},"italian-dpa-fines-employer-6600-for-unlawfully-accessing-former-employees-locker","Italian DPA Fines Employer €6,600 for Unlawfully Accessing Former Employee's Locker","2026-07-29T02:20:36.64+00:00",{"slug":27,"title":28,"published_at":29},"italian-dpa-fines-cosmint-for-unlawful-processing-of-former-employees-personal-data","Italian DPA Fines Cosmint for Unlawful Processing of Former Employee's Personal Data","2026-07-29T00:20:47.872+00:00",{"slug":31,"title":32,"published_at":33},"former-employees-retain-data-access-after-departure-triggering-gdpr-fine","Former Employees Retain Data Access After Departure, Triggering GDPR Fine","2026-06-30T18:21:12.538+00:00",[35,40,45,49,53],{"slug":36,"name":37,"problem":38,"stories":39},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",2,{"slug":41,"name":42,"problem":43,"stories":44},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",1,{"slug":46,"name":47,"problem":48,"stories":44},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":50,"name":51,"problem":52,"stories":44},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":54,"name":55,"problem":56,"stories":44},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[58,63,68,72,77,80,84,88],{"family":59,"item":60,"code":61,"title":62,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":64,"item":65,"code":66,"title":66,"together":67},"itil","overview","ITIL",3,{"family":59,"item":69,"code":70,"title":71,"together":67},"6","Article 6","Lawfulness of processing",{"family":73,"item":74,"code":75,"title":76,"together":39},"nist-800-53","ac-2","AC-2","Account Management",{"family":78,"item":60,"code":79,"title":76,"together":39},"cis","Control 5",{"family":59,"item":81,"code":82,"title":83,"together":39},"13","Article 13","Information to be provided where personal data are collected from the data subject",{"family":78,"item":85,"code":86,"title":87,"together":39},"3","Control 3","Data Protection",{"family":73,"item":89,"code":90,"title":91,"together":39},"ps-4","PS-4","Personnel Termination"]