Departing employee keeps access to customer systems
RSK-011
-
Last updated
Mitigated
Description
When an engineer leaves, they still know passwords and hold sessions on customer systems. Access that is not removed on the last day could be misused or exposed later.
Measures
The leaver checklist disables the identity, revokes the hardware keys, and rotates shared credentials on the last working day, and the HR Lead confirms each step. Every departure of the last year closed the checklist on time.
Review
On trackNext review is 2/9/2027 — no urgency right now.
- Review cadence
- Every 180 days
- Last reviewed
- Next review due