Offboarding Security Checklist Template (ISO/IEC 27001 A.6.5)

Offboarding Security Checklist: [Organization name]

Security checklist and procedure for people who leave the organization or change role: access revocation timed by risk, return of assets, handling of data on devices and in accounts, knowledge transfer, continuing confidentiality duties, and special handling of privileged and urgent leavers. It supports ISO/IEC 27001:2022 + Amd 1:2024, Annex A controls A.5.11 (return of assets), A.6.5 (duties after leaving or changing role), A.5.16 to A.5.18 (identity lifecycle, authentication information, access rights), A.8.2 (privileged access rights), A.7.10 and A.7.14 (storage media, secure disposal or re-use of equipment) and A.8.10 (information deletion), with guidance in ISO/IEC 27002:2022. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Roles and responsibilities
3. Leaver types and revocation timing
4. Triggers and notice
5. Leaver checklist
6. Mover checklist
7. Privileged and urgent leavers
8. Continuing duties after leaving
9. Verification and access review
10. Size tiers
11. Records and evidence
12. Metrics
13. References

1. Purpose and scope

This checklist makes sure that when a person leaves [Organization name] or changes role, access is removed on time, organizational assets and information are returned or securely deleted, knowledge is handed over, and the person knows which security duties continue after the change.

It covers employees, contractors, interns, agency staff, board members with accounts, and supplier personnel with named access. It also covers accounts, keys and secrets that the person owned or knew, including shared, service and break-glass credentials.

2. Roles and responsibilities

3. Leaver types and revocation timing

4. Triggers and notice

• HR records the leaving date as soon as it is known; the HR system or HR opens the JML ticket at least [5] business days before the last day for L1 and L2.
• Every contractor and supplier account has an end date at creation; accounts without an end date are reported weekly to the IT lead.
• For L3, HR contacts the security team and IT lead directly by [phone or secure channel], not through the ticket queue, and agrees the exact time of revocation.
• Supplier contracts require notice of personnel changes within [1] business day (DOC-ISMS-068).

5. Leaver checklist

5.1 Before the last day

5.2 On the last day

5.3 After the last day

Unreturned assets: escalate to HR within [2] business days, remotely lock or wipe the device where possible, and record the asset as lost in the asset inventory and, if it may hold Confidential information, as a security event (isms/security-event-reporting-procedure).

6. Mover checklist

7. Privileged and urgent leavers

For L2 and L3:

1. Security and IT prepare the revocation list in advance (privileged accounts, cloud root and admin roles, API keys, SSH keys, code signing and other keys in the key register DOC-ISMS-070, vault access, on-call tools).
2. For L3, revocation happens at the agreed time, before or at the moment the person is told. HR holds the meeting; IT confirms revocation in real time.
3. Rotate every secret the person knew, starting with production and customer-facing credentials.
4. Where policy and law allow, the security team reviews recent activity of the account (bulk downloads, forwarding rules, new keys) and opens a security event if anything unusual is found. Any evidence is preserved under security/forensic-evidence-record.
5. If a disciplinary matter is involved, follow isms/security-disciplinary-process.

8. Continuing duties after leaving

Remind every leaver, in writing, that:

• confidentiality obligations continue as set in the confidentiality agreement or employment contract (DOC-ISMS-051), including for trade secrets and personal data for as long as they keep that status;
• organization information must not be kept on personal devices, personal email or personal cloud storage, and any found later must be deleted and reported;
• intellectual property terms in the contract continue;
• the person must not use remembered credentials or access paths;
• the person may be contacted for knowledge transfer questions for [period] where agreed.

Do not include unlawful restrictions (for example on reporting to authorities or whistleblowing); legal counsel confirms the reminder text per country.

9. Verification and access review

• The IT lead checks that every step is complete or N/A with reason before closing the ticket.
• Weekly: reconcile HR leavers and contractor end dates against active accounts in the identity provider; any active account of a leaver is disabled at once and recorded as a security event.
• Quarterly: the access review (ops/access-review) includes systems not connected to the identity provider and shared accounts.
• The ISMS manager samples [5] completed leaver tickets per quarter and compares leaving time with disable time.

10. Size tiers

11. Records and evidence

12. Metrics

13. References

Related templates: ops/onboarding-checklist, ops/access-review, isms/access-control-policy, security/privileged-access-standard, security/secrets-management-standard, isms/cryptographic-key-register, compliance/asset-inventory, isms/endpoint-device-byod-policy, isms/equipment-disposal-reuse-record, isms/confidentiality-nda, isms/personnel-screening-procedure, isms/security-disciplinary-process, isms/security-event-reporting-procedure, data/data-retention-deletion-standard, security/security-logging-standard, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024, Annex A controls A.5.11, A.6.5, A.5.16 to A.5.18, A.8.2, A.7.10, A.7.14 and A.8.10, with guidance in ISO/IEC 27002:2022. The leaver types, timings, checklists, examples and guidance are original wording; no ISO or IEC text is reproduced. ISO and IEC standards are copyrighted: obtain the official standard from ISO or your national standards body (https://www.iso.org/standard/82875.html). Check the current edition and amendments before use, and confirm employment-related steps with legal counsel in each country. This is a documentation format, not legal advice. Template licence: MIT.