Map access paths from the handover time
Suppose an operations engineer at a company spanning several time zones completes a handover on Friday. The engineer signs into tickets with a corporate account, uses an existing browser session for the cloud console, holds remote access, and has deployed automation to a shared runtime. On receiving the HR notice, the manager confirms the effective time and its time zone and names an on-duty coordinator to follow each system. The successor takes custody of work materials handed over in advance. List account disablement, session termination, and service identity transfer separately, with a system, executor, and verifier for each. The end of the workday in different regions is rarely the same instant.
NIST’s catalog of security and privacy controls addresses the account lifecycle and its connection to personnel changes under Account Management. Personnel Termination covers revoking access, retrieving credentials, and preserving organizational access to information. The following steps translate those objectives into work and evidence an enterprise can organize. The coordinator starts with identity administrators to inventory centralized sign-in and local accounts. Application owners then identify external tenants, administrative roles, shared resources, and sessions that can still act. Use asset ownership records as a starting point and cross-check them against access lists and application audit records, especially for exceptions maintained by a branch.
Revoke access system by system
At the agreed time, identity administrators disable personal sign-in, revoke existing sessions and refresh credentials where supported, and keep the platform’s action times and results. Application owners check independent accounts, external collaboration spaces, and directly assigned roles and remove them individually. Network operators determine whether existing remote connections require termination at the access device and check synchronization delays. For paths using device certificates, hardware credentials, or separate authentication, follow the established process to identify who revokes or retrieves each item and when downstream systems can observe the change. The coordinator records pending propagation separately from execution failures. During the wait, the duty lead decides whether existing temporary restrictions are appropriate.
In shared runtimes, distinguish the deployer from the identity that actually runs the job. Application owners inspect the scheduler, vault references, and application configuration to establish which identity calls downstream systems and whether the former employee could read or regenerate that credential. For jobs still running under a personal identity, assign someone to move them to an authorized service identity during an approved window, limit its rights, and verify the scheduled job. If the employee had access to a shared credential that is still valid, follow the system’s controlled rotation procedure. Confirm dependencies and rollback conditions first, then test downstream rejection of the old credential. Track job and service ownership separately so alerts and configuration remain maintainable.
Verify with two sets of tests
First, the verifier uses an approved test environment and a test identity governed by the same policy to check a new login, a pre-existing browser session, and a long-lived connection after revocation. Where safe production session queries or audit interfaces exist, use production events to corroborate what was done to the target account, when, by whom, and to which object. Record how the test policy matches production and flag legacy systems and external tenants the environment cannot represent. Preserve the response and timestamp if a test fails. Avoid reusing the departing employee’s password or copying live tokens. Mark unverified paths as open and assign someone to gather evidence by the next check.
The business owner and successor administrator run the second set. Using their own accounts, they open handed-over materials, confirm they can continue pending tickets, and observe a representative automated run produce the expected result on schedule. Transfer retained copies and audit material only within the approved scope and review viewing rights alongside the evidence. The ticket can carry event IDs, application check times, outcomes, and the successor’s acknowledgment. Keep sensitive fields in an access-controlled system. If logs arrive late, keep both the event time and the observation time so the next shift can calculate the actual wait.
Decide when to close the ticket
A common mistake is to inspect only the disabled flag in the identity directory. If a path authenticates only at connection setup, existing connections may have a different lifecycle. Another mistake is deleting organizational files along with the account to close a ticket quickly, or changing every shared password without arranging dependency tests. Make access-control and continuity evidence joint handover conditions. If only the contractor can operate its tenant, request confirmation with the object scope and timestamp. Record which actions your team verified independently and which still depend on the contractor’s reply. One generic completion email cannot establish what happened in several systems.
Finally, the coordinator clears each item against the effective time and handover evidence. Keep items open if access remains active, the outcome is unknown, or the successor cannot perform a critical task. Give the next shift the risk owner, temporary measure, exception deadline, and retest method. Measure actual refresh intervals and revocation capabilities before setting follow-up deadlines. Where an employment dispute, information retention, or investigation is involved, let the appropriate owner determine the sequence and material scope under approved procedures. These checks apply to systems the enterprise is authorized to manage. They do not establish what happened to personal devices, independent third-party accounts, or local copies.
Sources
NIST SP 800-53 Rev. 5 (AC-2, PS-4)