6.5 Responsibilities after termination or change of employment
Security responsibilities and duties that continue after someone leaves or changes job are to be defined, made known to the people and outside parties concerned, and enforced. Purpose: protect the organization's interests when employment or contracts change or end. Guidance: the leaver and mover process should state which security responsibilities stay in force, for instance keeping information confidential and respecting intellectual property and know-how gained in the job, and obligations under other confidentiality agreements (6.6). Continuing duties belong in the person's employment terms (6.2), contract or agreement, and other agreements that run on for a set period can also carry them. A change of role or employment is handled as ending the current role and starting the new one. Security roles held by a person who leaves or moves are identified and handed to someone else. A process tells staff, outside parties and relevant contacts about the changes and the operating procedures such as customers and suppliers. The same process applies to external personnel from suppliers when their engagement, contract or job ends or changes. Other information: HR usually runs the overall termination process together with the person's manager, and for supplier-provided staff the supplier runs it under its contract with the organization.
Source: ISO/IEC 27002:2022, 6.5. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of security roles reassigned when their holders left or changed jobs · Identity provider / directory
- Evidence that the process is applied to supplier personnel through contract terms · Vendor register / contract repository
governing documentDocuments that govern the control
- Leaver and mover procedures stating which security responsibilities survive termination or change · Policy repository / GRC workspace
- Terms and conditions or agreements containing the continuing obligations and their duration · Vendor register / contract repository
- Exit communications reminding leavers of continuing confidentiality and intellectual property duties · Policy repository / GRC workspace
- Notifications of personnel changes to customers, suppliers and other contacts where relevant · Vendor register / contract repository
First move
Common gaps auditors find
- Leavers are not reminded of continuing confidentiality obligations
- Security roles such as system owner or key custodian are left vacant after someone leaves
- Internal moves are not treated as leave-and-join, so old access and duties persist
- External contacts keep dealing with people who no longer hold the role
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet6.4 Disciplinary process · 6.6 Confidentiality or non-disclosure agreements