Responsibilities after termination or change of employment

What the control asks

Security responsibilities and duties that continue after someone leaves or changes job are to be defined, made known to the people and outside parties concerned, and enforced. Purpose: protect the organization's interests when employment or contracts change or end. Guidance: the leaver and mover process should state which security responsibilities stay in force, for instance keeping information confidential and respecting intellectual property and know-how gained in the job, and obligations under other confidentiality agreements (6.6). Continuing duties belong in the person's employment terms (6.2), contract or agreement, and other agreements that run on for a set period can also carry them. A change of role or employment is handled as ending the current role and starting the new one. Security roles held by a person who leaves or moves are identified and handed to someone else. A process tells staff, outside parties and relevant contacts about the changes and the operating procedures such as customers and suppliers. The same process applies to external personnel from suppliers when their engagement, contract or job ends or changes. Other information: HR usually runs the overall termination process together with the person's manager, and for supplier-provided staff the supplier runs it under its contract with the organization.

Purpose in the standard’s terms, in our words: Protects the organization's interests when employment or contracts change or end.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Human resource security, Asset management; Governance and ecosystem.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Leaver and mover procedures stating which security responsibilities survive termination or change
• Terms and conditions or agreements containing the continuing obligations and their duration
• Records of security roles reassigned when their holders left or changed jobs
• Exit communications reminding leavers of continuing confidentiality and intellectual property duties
• Notifications of personnel changes to customers, suppliers and other contacts where relevant
• Evidence that the process is applied to supplier personnel through contract terms

Where audits commonly find gaps

• Leavers are not reminded of continuing confidentiality obligations
• Security roles such as system owner or key custodian are left vacant after someone leaves
• Internal moves are not treated as leave-and-join, so old access and duties persist
• External contacts keep dealing with people who no longer hold the role

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (07.3.1) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 6.1 Screening
• 6.2 Terms and conditions of employment
• 6.3 Information security awareness, education and training

Read the five attributes All 93 controls