A.6.5Responsibilities after termination or change of employment
Make clear which security responsibilities continue after someone leaves or changes role, such as confidentiality duties, and enforce them. Some obligations must outlast the working relationship.
Mapping at a glance
A.6.5Responsibilities after termination or change of employmentISO/IEC 27001:2022
What an auditor, or Sekit's evidence engine, asks for.
Joiner-mover-leaver procedure
The process the company follows when someone joins, changes role, or leaves: how access and devices are granted and removed.
From the Sekit evidence catalog
In practice
In practice this means the joiner-mover-leaver procedure names an exact deadline, typically the last working day, by which a departing employee's access is fully revoked, and someone owns triggering that removal. Auditors ask HR and IT to walk through a real leaver from the last few months and check the timestamps: when HR flagged the departure, when access was cut, and whether it happened before or after the deadline the procedure promises. The common gap is HR knowing about a departure days before IT does, leaving accounts active well past the person's last day.
Common gaps
IT learns about an employee's departure days after HR does, leaving accounts and access active past the person's last working day.
The joiner-mover-leaver procedure covers access removal but says nothing about ongoing confidentiality obligations that continue after employment ends.
Role changes are handled inconsistently: some moves trigger an access review, others add new access without removing what the old role no longer needs.
Questions your auditor will ask
How quickly is a leaver's access revoked after departure?
The joiner-mover-leaver procedure sets a deadline, usually the last working day, and access logs show when revocation happened for a sample leaver.
Who tells IT when someone leaves or changes role?
HR triggers the joiner-mover-leaver procedure the moment a departure or role change is confirmed, with the trigger and timestamp recorded.
What confidentiality obligations continue after someone leaves the company?
The employment terms specify which duties, such as confidentiality, continue past the employment relationship, referenced from the joiner-mover-leaver procedure.
Where regulation demands it
NIS2 10.3 covers termination or change of employment directly, the exact scope A.6.5 addresses.
ENS op.acc.4 requires a defined process for managing access rights, which is what revokes a leaver's access on schedule.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.