Responsibilities after termination or change of employment

What the requirement asks

Security responsibilities and duties that continue after someone leaves or changes job are to be defined, enforced and communicated to the people and outside parties concerned. Purpose: protect the organization's interests when employment or contracts change or end. Guidance: the leaver and mover process should state which security responsibilities stay in force, for instance keeping information confidential and respecting intellectual property and know-how gained in the job, and obligations under other confidentiality agreements (6.6). Continuing duties belong in the person's employment terms (6.2), contract or agreement, and other agreements that run on for a set period can also carry them. A change of role or employment is handled as ending the current role and starting the new one. Security roles held by a person who leaves or moves are identified and handed to someone else. A process tells staff, outside parties and relevant contacts about the changes and the operating procedures such as customers and suppliers. The same process applies to external personnel from suppliers when their engagement, contract or job ends or changes. Other information: HR usually runs the overall termination process together with the person's manager, and for supplier-provided staff the supplier runs it under its contract with the organization. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Responsibilities after leaving are easy to forget. The guidance asks for the continuing duty, the reminder, the duration and the owner.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep leaver and mover procedures stating which security responsibilities survive termination or change and one live sample together.

Evidence an assessor asks for

• Post-employment obligationsLeaver and mover procedures stating which security responsibilities survive termination or change
• Post-employment obligationsTerms and conditions or agreements containing the continuing obligations and their duration
• Post-employment obligationsRecords of security roles reassigned when their holders left or changed jobs
• Post-employment obligationsExit communications reminding leavers of continuing confidentiality and intellectual property duties
• Post-employment obligationsNotifications of personnel changes to customers, suppliers and other contacts where relevant
• Post-employment obligationsEvidence that the process is applied to supplier personnel through contract terms

The question an assessor will ask

An assessor will ask for leaver and mover procedures stating which security responsibilities survive termination or change, then trace it to the system it protects. For A.6.5 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Leavers are not reminded of continuing confidentiality obligations
• Security roles such as system owner or key custodian are left vacant after someone leaves
• Internal moves are not treated as leave-and-join, so old access and duties persist
• External contacts keep dealing with people who no longer hold the role

Before the next audit

Before the next audit, check one live sample for this gap: leavers are not reminded of continuing confidentiality obligations.