THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · PS-4

Personnel Termination

US National Institute of Standards and Technology (NIST) · cited in 8 of our lessons

Explanation

What it asks for. When employment ends, the organisation must disable system access within a defined time, revoke authenticators and credentials, hold exit interviews covering defined topics, retrieve security-related property and keep access to information and systems the person formerly controlled.

In practice. Doing this well means an automated leaver process triggered by HR, disabling accounts promptly, revoking tokens and certificates, collecting devices and badges, and transferring ownership of data and accounts. Auditors expect leaver reports compared with account disable dates and records of returned equipment. Managers should confirm handover of business data before accounts are deleted.

Common gaps. Accounts in SaaS tools outside single sign-on often stay active after people leave. Personal access tokens and API keys created by former staff are commonly forgotten. Shared passwords known to the leaver are often not changed.

Open SP 800-53 at NIST
The official text
Upon termination of individual employment: a. Disable system access within [Assignment: organization-defined time period]; b. Terminate or revoke any authenticators and credentials associated with the individual; c. Conduct exit interviews that include a discussion of [Assignment: organization-defined information security topics]; d. Retrieve all security-related organizational system-related property; and e. Retain access to organizational information and systems formerly controlled by terminated individual. Discussion: System property includes hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that proper accountability is achieved for system-related property. Security topics at exit interviews include reminding individuals of nondisclosure agreements and potential limitations on future employment. Exit interviews may not always be possible for some individuals, including in cases related to the unavailability of supervisors, illnesses, or job abandonment. Exit interviews are important for individuals with security clearances. The timely execution of termination actions is essential for individuals who have been terminated for cause. In certain situations, organizations consider disabling the system accounts of individuals who are being terminated prior to the individuals being notified.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.