What is the best way to handle access requests from terminated employees?

1 Review the policy

Before you respond to any access request from a terminated employee, you should review the policy and procedures that your organization has in place for offboarding. These may vary depending on the nature of the termination, the role and responsibilities of the employee, and the legal and regulatory obligations that apply to your industry and location. The policy should specify what types of access are revoked, when and how they are revoked, and who is authorized to grant or deny exceptions. You should also consult with your human resources, legal, and information security teams to ensure that you are following the best practices and standards for your organization.

2 Verify the identity

The next step is to verify the identity of the person who is requesting access. This may seem obvious, but it is important to avoid phishing or impersonation attempts that could compromise your security. You should use a secure and reliable method of communication, such as a phone call, a video call, or an encrypted email, to confirm the identity and contact details of the former employee. You should also ask for some proof of identity, such as a photo ID, a security question, or a verification code, to ensure that you are dealing with the right person.

3 Evaluate the request

Once you have verified the identity of the former employee, you should evaluate the request and determine whether it is valid, reasonable, and necessary. You should ask for the details and justification of the request, such as what kind of access they need, why they need it, how long they need it, and how they will use it. You should also consider the potential risks and benefits of granting or denying the request, such as the impact on security, privacy, compliance, business continuity, and reputation. You should weigh these factors against the policy and procedures that you reviewed earlier and decide whether the request meets the criteria for an exception.

4 Document the decision

After you have made your decision, you should document it and communicate it to the former employee and the relevant stakeholders in your organization. You should explain the rationale and evidence behind your decision, as well as the terms and conditions that apply if you grant the request. You should also record the date, time, and duration of the access, the scope and purpose of the access, and the actions and outcomes of the access. You should store this documentation in a secure and accessible location, such as a database, a spreadsheet, or a ticketing system, for future reference and audit purposes.

5 Monitor the access

If you decide to grant the access request from the terminated employee, you should monitor the access and ensure that it is used appropriately and securely. You should use tools and techniques, such as logs, alerts, reports, and audits, to track and verify the activities and transactions of the former employee. You should also enforce the limits and controls that you set for the access, such as the expiration date, the password policy, the encryption policy, and the access rights. You should be ready to revoke or suspend the access if you detect any misuse, abuse, or breach of the access.

6 Learn from the experience

Finally, you should learn from the experience and use it to improve your information security posture and processes. You should review the feedback and lessons learned from the access request and identify any gaps, issues, or opportunities for improvement. You should also update your policy and procedures for offboarding and access management, as well as your training and awareness programs for your employees and managers. You should aim to minimize the need for access requests from terminated employees and maximize the security and efficiency of your information systems and resources.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?