8.2.5 Access for terminated users is immediately revoked
Access for terminated users is immediately revoked.
5
artefacts
1
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Termination information source, such as the human resources leaver feed, and evidence it reaches the access administration process · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence terminated user IDs are deactivated or removed immediately rather than at the next review · Document repository
- Records of physical authentication factors returned or disabled, such as tokens and cards · Physical access / facilities
- Timing evidence showing the interval between termination and revocation · HR system / LMS
governing documentDocuments that govern the control
- Current user access lists for both local and remote access, checked against recent terminations · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Identity provider / directory on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Revocation covers the directory while local accounts on servers, appliances and applications remain active
- Contractors and third party staff not on the leaver feed, so their access survives the engagement
- Revocation batched to a weekly job, which does not meet the immediate requirement
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.2.4 Addition, deletion, and modification of user IDs, authentication factors, and other identifier objects are managed as follows: • Authorized with the appropriate approval. • Implemented with only the privileges specified on the documented approval · 8.2.6 Inactive user accounts are removed or disabled within 90 days of inactivity