HR-05 Responsibilities in the event of termination or change of employment
Inform internal and external personnel which information security obligations from their engagement terms continue to apply after their employment ends or changes, and state how long each of those obligations remains bin
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Leaver and internal mover checklist containing the notification step and its sign off · Identity provider / directory
periodic reviewEvidence produced at each review
- Signed acknowledgements collected from a sample of recent leavers · Identity provider / directory
governing documentDocuments that govern the control
- Contract clause specifying which duties survive departure and for what period · Vendor register / contract repository
- Exit or role change form recording that the continuing duties were explained to the individual · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Surviving duties buried in the contract and never restated at the point of departure
- Internal transfers processed with no review of which duties the person retains
- Duration of the continuing obligation left unspecified
- Departures of external personnel handled by the agency with no provider side record
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetHR-04 Disciplinary measures · HR-06 Confidentiality agreements