Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.09.02Personnel termination and transferITSP.10.171Personnel security

Official Requirement

A. When individual employment is terminated: 1. disable system access within [Assignment: organization-defined time period] 2. terminate or revoke authenticators and credentials associated with the individual 3. retrieve security-related system property B. When individuals are reassigned or transferred to other positions in the organization: 1. review and confirm the ongoing operational need for current logical and physical access authorizations to the system and facility 2. modify access authorization to correspond with any changes in operational need

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

When someone leaves the organization, their access must be disabled promptly, all credentials revoked, and all company-issued security property (badges, laptops, tokens) collected. When someone transfers to a new role, their access must be reviewed and adjusted to match their new responsibilities -- old access they no longer need must be removed.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon
View in Map →

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

Truvo CyberTruvo CyberBuilt and maintained by Truvo Cyber
Authors·Connect with us
Updated: Mar 22, 2026Reviewed: Mar 22, 2026v1.0.0
Share this tool

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

Termination and transfer access management

Implementation steps

  1. Establish a formal offboarding process triggered by HR termination notification, requiring account disablement within the defined time period
  2. Disable Active Directory accounts, revoke VPN certificates, and reset any shared passwords the departing user had access to
  3. Collect all organizational property including badges, hardware tokens, laptops, and access keys; document retrieval
  4. For transfers, conduct an access review with the new supervisor to adjust AD group memberships and application access to match the new role

Tools / systems

Evidence artifacts

Evidence frequency: Per-event at termination or transfer; quarterly audit of terminated accounts still active