[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fps-4":3},{"item":4,"lessons":18,"controls":52,"related":80},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ps-4","PS-4","Personnel Termination",8,"US National Institute of Standards and Technology (NIST)","**What it asks for.** When employment ends, the organisation must disable system access within a defined time, revoke authenticators and credentials, hold exit interviews covering defined topics, retrieve security-related property and keep access to information and systems the person formerly controlled.\n\n**In practice.** Doing this well means an automated leaver process triggered by HR, disabling accounts promptly, revoking tokens and certificates, collecting devices and badges, and transferring ownership of data and accounts. Auditors expect leaver reports compared with account disable dates and records of returned equipment. Managers should confirm handover of business data before accounts are deleted.\n\n**Common gaps.** Accounts in SaaS tools outside single sign-on often stay active after people leave. Personal access tokens and API keys created by former staff are commonly forgotten. Shared passwords known to the leaver are often not changed.","Upon termination of individual employment:\n  a. Disable system access within [Assignment: organization-defined time period];\n  b. Terminate or revoke any authenticators and credentials associated with the individual;\n  c. Conduct exit interviews that include a discussion of [Assignment: organization-defined information security topics];\n  d. Retrieve all security-related organizational system-related property; and\n  e. Retain access to organizational information and systems formerly controlled by terminated individual.\nDiscussion: System property includes hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that proper accountability is achieved for system-related property. Security topics at exit interviews include reminding individuals of nondisclosure agreements and potential limitations on future employment. Exit interviews may not always be possible for some individuals, including in cases related to the unavailability of supervisors, illnesses, or job abandonment. Exit interviews are important for individuals with security clearances. The timely execution of termination actions is essential for individuals who have been terminated for cause. In certain situations, organizations consider disabling the system accounts of individuals who are being terminated prior to the individuals being notified.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48],{"slug":21,"title":22,"published_at":23},"insider-threat-engineer-abuses-privileged-access-for-extortion","Insider Threat: Engineer Abuses Privileged Access for Extortion","2026-10-10T12:20:32.176+00:00",{"slug":25,"title":26,"published_at":27},"insider-threat-rogue-engineer-locks-3000-devices-in-ransomware-style-attack","Insider Threat: Rogue Engineer Locks 3,000 Devices in Ransomware-Style Attack","2026-10-06T10:21:20.11+00:00",{"slug":29,"title":30,"published_at":31},"insider-grievance-fuels-public-microsoft-defender-exploit-release","Insider Grievance Fuels Public Microsoft Defender Exploit Release","2026-09-22T14:20:57.628+00:00",{"slug":33,"title":34,"published_at":35},"romanian-retailer-fined-54300-for-allowing-ex-employee-data-access-and-consent-failures","Romanian Retailer Fined €54,300 for Allowing Ex-Employee Data Access and Consent Failures","2026-08-18T16:20:40.216+00:00",{"slug":37,"title":38,"published_at":39},"italian-dpa-fines-cosmint-for-unlawful-processing-of-former-employees-personal-data","Italian DPA Fines Cosmint for Unlawful Processing of Former Employee's Personal Data","2026-07-29T00:20:47.872+00:00",{"slug":41,"title":42,"published_at":43},"former-employees-retain-data-access-after-departure-triggering-gdpr-fine","Former Employees Retain Data Access After Departure, Triggering GDPR Fine","2026-06-30T18:21:12.538+00:00",{"slug":45,"title":46,"published_at":47},"former-employees-retain-data-access-costing-polish-sub-processor-gdpr-fine","Former Employees Retain Data Access, Costing Polish Sub-Processor GDPR Fine","2026-06-30T10:21:45.066+00:00",{"slug":49,"title":50,"published_at":51},"unauthorized-app-use-and-poor-subprocessor-oversight-lead-to-gdpr-breach-in-poland","Unauthorized App Use and Poor Subprocessor Oversight Lead to GDPR Breach in Poland","2026-06-26T14:20:43.981+00:00",[53,58,63,68,72,76],{"slug":54,"name":55,"problem":56,"stories":57},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",6,{"slug":59,"name":60,"problem":61,"stories":62},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",4,{"slug":64,"name":65,"problem":66,"stories":67},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":69,"name":70,"problem":71,"stories":67},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":73,"name":74,"problem":75,"stories":67},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":77,"name":78,"problem":79,"stories":67},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[81,87,90,95,99,103,107,111],{"family":82,"item":83,"code":84,"title":85,"together":86},"cis","5","Control 5","Account Management",7,{"family":5,"item":88,"code":89,"title":85,"together":57},"ac-2","AC-2",{"family":82,"item":91,"code":92,"title":93,"together":94},"6","Control 6","Access Control Management",5,{"family":96,"item":83,"code":97,"title":98,"together":94},"gdpr","Article 5(1)(f)","Principles relating to processing of personal data",{"family":100,"item":101,"code":102,"title":102,"together":94},"itil","overview","ITIL",{"family":96,"item":104,"code":105,"title":106,"together":94},"32","Article 32","Security of processing",{"family":5,"item":108,"code":109,"title":110,"together":62},"ac-6","AC-6","Least Privilege",{"family":96,"item":112,"code":113,"title":114,"together":115},"28","Article 28","Processor",3]