+PS-04 Personnel Termination
---+PS-04(01) Post-employment Requirements
---+PS-04(02) Automated Actions

PS-04 Personnel Termination

Control

Upon termination of individual employment:
  1. Disable system access within [Assignement: time period];
  2. Terminate or revoke any authenticators and credentials associated with the individual;
  3. Conduct exit interviews that include a discussion of [Assignement: information security topics];
  4. Retrieve all security-related organizational system-related property; and
  5. Retain access to organizational information and systems formerly controlled by terminated individual.

Discussion

System property includes hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that proper accountability is achieved for system-related property. Security topics at exit interviews include reminding individuals of nondisclosure agreements and potential limitations on future employment. Exit interviews may not always be possible for some individuals, including in cases related to the unavailability of supervisors, illnesses, or job abandonment. Exit interviews are important for individuals with security clearances. The timely execution of termination actions is essential for individuals who have been terminated for cause. In certain situations, organizations consider disabling the system accounts of individuals who are being terminated prior to the individuals being notified.

Assessment Objective

  1. upon termination of individual employment, system access is disabled within [Assignement: time period];
  2. upon termination of individual employment, any authenticators and credentials are terminated or revoked;
  3. upon termination of individual employment, exit interviews that include a discussion of [Assignement: information security topics] are conducted;
  4. upon termination of individual employment, all security-related organizational system-related property is retrieved;
  5. upon termination of individual employment, access to organizational information and systems formerly controlled by the terminated individual are retained.

Assessment Method

Examine

Personnel security policy procedures addressing personnel termination records of personnel termination actions list of system accounts records of terminated or revoked authenticators/credentials records of exit interviews system security plan other relevant documents or records

Interview

Organizational personnel with personnel security responsibilities organizational personnel with account management responsibilities system/network administrators organizational personnel with information security responsibilities

1. Vue d’ensemble

PS-04(01) Post-employment Requirements

Control

  1. Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information; and
  2. Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.

Discussion

Organizations consult with the Office of the General Counsel regarding matters of post-employment requirements on terminated individuals.

Assessment Objective

  1. terminated individuals are notified of applicable, legally binding post-employment requirements for the protection of organizational information;
  2. terminated individuals are required to sign an acknowledgement of post-employment requirements as part of the organizational termination process.

Assessment Method

Examine

Personnel security policy procedures addressing personnel termination signed post-employment acknowledgement forms list of applicable, legally binding post-employment requirements system security plan other relevant documents or records

Interview

Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities
PS-04(02) Automated Actions

Control

Use [Assignement: automated mechanisms] to [Selection(one-or-more): notify {{ insert: param, ps-04.02_odp.03 }} of individual termination actions; disable access to system resources].

Discussion

In organizations with many employees, not all personnel who need to know about termination actions receive the appropriate notifications, or if such notifications are received, they may not occur in a timely manner. Automated mechanisms can be used to send automatic alerts or notifications to organizational personnel or roles when individuals are terminated. Such automatic alerts or notifications can be conveyed in a variety of ways, including via telephone, electronic mail, text message, or websites. Automated mechanisms can also be employed to quickly and thoroughly disable access to system resources after an employee is terminated.

Assessment Objective

[Assignement: automated mechanisms] are used to [Selection(one-or-more): notify {{ insert: param, ps-04.02_odp.03 }} of individual termination actions; disable access to system resources].

Assessment Method

Examine

Personnel security policy procedures addressing personnel termination system design documentation system configuration settings and associated documentation records of personnel termination actions automated notifications of employee terminations system security plan other relevant documents or records

Interview

Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations

Tickets liés

Liens
is blocked by PS-04 Personnel Termination – Assessment Procedure
is blocked by Personnel Termination