10.3 Termination or change of employment procedures

Requirement

The relevant entities shall ensure that network and information system security responsibilities and duties that remain valid after termination or change of employment of their employees are contractually defined and enforced.

Guidance

• Include specific clauses in employment contracts that outline the ongoing security responsibilities and duties of employees after their employment ends or their role changes.

Examples of evidence

• Documents, such as terms and conditions of employment, contracts or agreements, outlining responsibilities and duties still valid after termination of employment or contract.

Requirement

For the purpose of point 10.3.1., the relevant entities shall include in the individual’s terms and conditions of employment, contract or agreement the responsibilities and duties that are still valid after termination of employment or contract, such as confidentiality clauses.

Guidance

• Ensure these clauses cover the protection of confidential information, return of company property and restrictions on accessing the entity’s network and information systems.
• Revoke access to network and information systems in a timely manner upon termination or role change.
• Identify and document all assets to be returned upon termination or change of employment.
• After a change of employment, brief and inform personnel on the procedures in place.

Examples of evidence

• Records confirming the timely return of the entity’s assets.
• Records confirming the timely revocation of access rights.
• Copies of written notifications to the employee about the termination of or change in employment status.

Tips: guidance

• Identify and transfer to another individual network and information security roles and responsibilities held by any individual who leaves the organisation.
• Where deemed reasonably necessary, conduct thorough exit interviews to remind departing employees of their ongoing security responsibilities.
• Collect company property and revoke access to systems.
• Monitor for any unauthorized access attempts by former employees. Use security tools to detect and respond to suspicious activities. Maintain logs of access attempts and investigate any anomalies.
• Regularly review and update policies related to post-employment security responsibilities to ensure they remain effective and aligned with current legal and regulatory requirements. Keep a record of changes and ensure that it is up to date.
• Take into account changes or past incidents when reviewing the process
• Involve legal and human resources (HR) departments in the review process to ensure comprehensive coverage.

Tips: examples of evidence

• Records of all contractual agreements, non-disclosure agreements, exit interviews and access revocations, and any legal action taken.
• Documentation showing that the process is reviewed regularly and updated as necessary.
• Evidence that the employee’s access to the entity’s systems and facilities has been revoked or altered in accordance with a process.
• Documentation of the process for personnel changes, including responsibilities for managing changes, description of rights of access and possession of assets for each role, and procedures for briefing and training personnel in new roles (e.g. standardised checklists used during the termination process to ensure all necessary steps are taken).