Requirement
Personnel access to information and technology assets must be reviewed and removed immediately upon termination/separation.
Control Implementation Guidelines
- Define and document the requirements of this ECC in the cybersecurity requirements document and approve them by the representative
- Review access of employees and revoke it immediately after the end/termination of their professional service at the organization, which may include the following
- Define professional end-of-service or termination procedures covering cybersecurity requirements
- Ensure the return of all organization's assets and revoke employees' access rights immediately upon the end of their relationship with the organization
Expected Deliverables
- A discharge form with a signed and approved sample for the implementation of the procedures
