Follow one person's access from offer letter to exit interview

1. 1

   Joining

   Her manager raises a request before her start date, tied to the support analyst role.

   What happens

   • HR record creates a single identity in the directory
   • Role template grants the helpdesk tool, email and the knowledge base
   • Multi-factor sign-in is enforced from the first login

   You get

   • An approved request
   • A list of what was granted and when

   Good practice

   • Nothing is granted that the role template does not list
   • The approver is not the person receiving access

   Watch for

   • Cloning a colleague's account and everything it has gathered

2. 2

   Changing roles

   Eighteen months later she joins the engineering team.

   What happens

   • New role template grants code repositories and staging
   • Support tool access is removed, not left alongside
   • Production access waits for a separate, justified request

   You get

   • A transfer ticket showing both additions and removals

   Good practice

   • Old access ends on the transfer date

   Watch for

   • Permission creep: a mover who keeps every past role's rights

3. 3

   Elevated work

   An incident needs her to touch the production database for one evening.

   What happens

   • She requests privileged access for a fixed window
   • A senior engineer approves it
   • The session is logged and expires on its own

   You get

   • An approval, a time limit and a session record

   Good practice

   • Admin rights are borrowed, not owned

   Watch for

   • Standing admin accounts shared by the whole team

4. 4

   Leaving

   She resigns and works out her notice.

   What happens

   • HR's exit date triggers deactivation of the directory identity
   • Owners of systems outside single sign-on are notified
   • Her laptop and tokens come back; shared secrets she knew are rotated

   You get

   • A deprovisioning record with timestamps for each system

   Good practice

   • Removal on the last working day, checked against an inventory

   Watch for

   • Forgotten local accounts in tools that bypass single sign-on

In Meera's story the role templates are RBAC. The time-boxed production window is closer to ABAC, because the decision depends on an attribute (the approved time window) rather than her job title alone.

1. Export the current user list and permissions from each in-scope system.
2. Send each list to the person who owns that system or data, not to IT alone.
3. The owner confirms or revokes every line, and signs off.
4. IT removes the revoked access and records the change.
5. Keep the export, the decisions and the removal tickets together as evidence.

A review that only ever returns "all fine" is a warning sign in itself. Movers and contractors almost always leave something behind. Commonly, companies review sensitive and production systems quarterly and the rest less often; set the frequency in your access control policy and keep to it.

1. A..1
   5.3 Segregation of dutiesThe person approving access is not the one receiving it.
2. A..2
   5.15 Access controlThe written rules: who may approve what, and on which basis.
3. A..3
   5.16 Identity managementOne identity per person, through its whole life.
4. A..4
   5.17 Authentication informationHow passwords and other secrets are issued and protected.
5. A..5
   5.18 Access rightsGranting, changing, reviewing and removing rights.
6. A..6
   6.5 Responsibilities after termination or change of employmentDuties that outlast the job, such as confidentiality.
7. A..7
   8.2 Privileged access rightsAdmin access: restricted, approved and logged.
8. A..8
   8.3 Information access restrictionLimits inside systems, matched to the access policy.
9. A..9
   8.5 Secure authenticationSign-in strength, including multi-factor where risk calls for it.

• In a SOC 2 examination, the same evidence answers the logical access criteria CC6.1 to CC6.3.
• Under the GDPR, access limits are one of the security measures Article 32 expects for personal data.

• Annex A organizational controlsThe 37 controls of the first theme, grouped by what they do.
• Annex A technological controlsThe 34 controls on systems, networks, code and data.

• A sample of new starters. Each has an approved request dated before or on the grant date.
• A sample of movers. Old-role access was removed, not just new access added.
• A sample of leavers. HR exit dates matched against deactivation timestamps in every in-scope system.
• Privileged accounts. A current list, a reason for each, and logs of use.
• Review records. Every scheduled review happened, with owner decisions and follow-up removals.

Sources: ISO/IEC 27001:2022 Annex A control titles 5.3, 5.15 to 5.18, 6.5, 8.2, 8.3 and 8.5 (public); ISO/IEC 27002:2022 control titles; AICPA 2017 Trust Services Criteria (revised points of focus, 2022), CC6.1 to CC6.3; Regulation (EU) 2016/679, Article 32. Descriptions are our own.