A.6.5 Responsibilities after termination or change of employment
Define and enforce security responsibilities that remain valid after an exit or role change.
12
artefacts
2
held by a system
5
at each review
hard
to go live
HR system / LMS
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- IT system access revocation tickets · Ticketing / ITSM
- Active Directory de‑provisioning logs · Identity provider / directory
periodic reviewEvidence produced at each review
- HR exit interview notes · HR system / LMS
- VPN account disablement record · Identity provider / directory
- Security token collection record · SIEM / log platform
- Signed NDA post‑termination · HR system / LMS
- Exit interview acknowledgment of confidentiality obligations · HR system / LMS
governing documentDocuments that govern the control
- Employee termination checklist · HR system / LMS
- Manager sign‑off form · Document repository
- Laptop return receipt · Policy repository / GRC workspace
- Mobile device surrender form · Policy repository / GRC workspace
- Legal counsel clearance letter · HR system / LMS
First move
Mostly documents and reviews. Pull the 2 system-held artefacts from your Ticketing / ITSM on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Delayed revocation of privileged accounts
- Incomplete asset collection
- No documented acknowledgment of ongoing confidentiality duties
- Reliance on informal verbal handover
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.6.4 Disciplinary process · A.6.6 Confidentiality or non-disclosure agreements