Audit — PS-4 — Personnel Termination

Examine Review the personnel termination / offboarding policy and procedure to confirm it defines the specific time period within which system access must be disabled upon termination, and specifies steps for authenticator revocation, exit interviews, property retrieval, and retention of the individual's information.

Examine For a sample of individuals terminated in the audit period, examine offboarding tickets/HR records to confirm system access was disabled within the organization-defined time period (e.g., same business day or defined hours) of the termination effective date (CIS Control 6.2).

Test In the directory/identity provider (Active Directory, IdP, or IAM), verify that a sample of terminated users' accounts are disabled or removed and no active enabled account remains for those individuals (CIS Control 5.3).

Test Confirm that authenticators and credentials tied to sampled terminated individuals — passwords, MFA tokens/registrations, SSH keys, VPN certificates, PIV/smart cards, and privileged or shared-account credentials they knew — have been revoked or rotated (CIS Control 6.2).

Interview Interview HR and IT/security staff to confirm the notification workflow that triggers deprovisioning when an employee is terminated, including how and how quickly IT is alerted for both planned and immediate (involuntary) terminations.

Examine Examine exit interview and property-return records for the sample to verify that information security topics (ongoing confidentiality/NDA obligations, non-disclosure of sensitive data) were covered and that organization-issued property (laptops, tokens, badges, keys, mobile devices) was returned and documented.

Examine Verify that access to information and systems formerly controlled by the terminated individual is retained by the organization — e.g., mailboxes, files, and accounts are preserved or ownership transferred rather than deleted — for a sample of terminations.