Workforce Security
Access and company assets are removed or recovered when personnel leave, change roles, or no longer require access.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
When someone leaves or changes roles, access that is no longer needed is removed promptly, company assets are recovered or securely handled, credentials are rotated when necessary, and completion is independently verified.
First SOC 2 program
Use one HR-triggered departure or role-change ticket with a named coordinator, a list of business systems and assigned devices, and same-day handling for sensitive access. Centralize authentication where possible so a small team can disable access reliably.
As the company scales
Connect the HR system to identity, device, SaaS, code, and ticketing platforms. Automate routine revocation, preserve a manual path for privileged and shared credentials, measure completion against risk-based timing, and reconcile departed users against active accounts.
Require HR or the responsible manager to submit the departure or role-change event with effective time, urgency, manager, and asset details.
You should end up with: A timestamped mover or leaver ticket with an accountable coordinator.
Use identity, SaaS, code, cloud, privileged-access, and device records to identify accounts, tokens, group memberships, devices, keys, and records owned by the person.
You should end up with: A person-specific revocation and recovery checklist attached to the ticket.
Disable the primary identity, revoke sessions and direct accounts, remove group and privileged access, and adjust access for a role change at the effective time.
You should end up with: System timestamps or administrative logs showing each revocation.
Reassign repositories, service ownership, support queues, and records; rotate shared secrets or keys known to the person when risk warrants it.
You should end up with: Ownership-transfer records and credential-rotation logs.
Record return of laptops, badges, keys, and other assets, or authorize and verify remote lock or wipe when physical return is not feasible.
You should end up with: Asset receipt, shipping record, or device lock and wipe status.
Have the coordinator confirm all steps, investigate failed automation, and obtain manager or IT review before closing the event.
You should end up with: A completed ticket with verification, exceptions, and closure approval.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Shows that a specific departure or role change triggered coordinated access, ownership, credential, and asset actions at the intended effective time.
Include this context
person identifier
Include this context
event type
Include this context
effective date and time
Include this context
manager and coordinator
Include this context
assigned system and asset tasks
Include this context
closure approval
Weak evidence to avoid
A ticket titled offboard user that was opened after departure and contains only a checked disable-account box.
Confirm what the record proves
Shows actual revocation in identity, SaaS, cloud, code, support, and privileged systems, including sessions and direct accounts relevant to the person.
Include this context
person or account identifier
Include this context
system and access removed
Include this context
revocation timestamp
Include this context
performer or automation identity
Include this context
result or verification status
Weak evidence to avoid
A completed ticket with no administrative log, account status, revocation timestamp, or list of downstream systems.
Confirm what the record proves
Shows that each assigned device, badge, key, or other company asset was returned, reassigned, locked, wiped, or otherwise securely resolved.
Include this context
person identifier
Include this context
asset identifier and type
Include this context
return or secure-handling action
Include this context
action date
Include this context
recipient or verifier
Include this context
final asset status
Weak evidence to avoid
A note saying laptop returned without a serial number, receipt date, recipient, or device-management status.
Confirm what the record proves
Shows that shared passwords, keys, tokens, or other credentials known to a departing or transferred person were identified and changed when the risk required it.
Include this context
credential or system identifier
Include this context
reason and related personnel event
Include this context
rotation timestamp
Include this context
performer
Include this context
validation result
Weak evidence to avoid
A statement that shared credentials were rotated with no affected secret, system, timestamp, or validation result.
Type 1
The current HR and contractor mover-leaver workflow, named owners, timing requirements, and identity and device revocation configuration, together with the latest completed event and any event open on the examination date. If no mover or leaver occurred, include complete dated zero-occurrence exports from HR and contractor rosters reconciled to identity, direct-account, device, asset, privileged-access, and offboarding sources, with the reviewer and result recorded.
Type 2
Every employee and in-scope contractor termination and every role change during the review period, including involuntary and urgent events, together with each resulting revocation, asset-recovery, ownership-transfer, and required credential-rotation task.
Reconcile all termination and role-change events from HR and the contractor roster to offboarding tickets, then compare each person with identity, direct-account, device, asset, and privileged-access exports; investigate active access, assigned assets, or incomplete tasks after the required effective time.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: When someone leaves or changes roles, access that is no longer needed is removed promptly, company assets are recovered or securely handled, credentials are rotated when necessary, and completion is independently verified.
Compare the documented owner with the intended role (HR Owner / IT / CISO), then compare dated records with the stated cadence: Upon hire/change/termination; annual as applicable.
Reconcile all termination and role-change events from HR and the contractor roster to offboarding tickets, then compare each person with identity, direct-account, device, asset, and privileged-access exports; investigate active access, assigned assets, or incomplete tasks after the required effective time.
The current HR and contractor mover-leaver workflow, named owners, timing requirements, and identity and device revocation configuration, together with the latest completed event and any event open on the examination date. If no mover or leaver occurred, include complete dated zero-occurrence exports from HR and contractor rosters reconciled to identity, direct-account, device, asset, privileged-access, and offboarding sources, with the reviewer and result recorded.
Every employee and in-scope contractor termination and every role change during the review period, including involuntary and urgent events, together with each resulting revocation, asset-recovery, ownership-transfer, and required credential-rotation task.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Shows that a specific departure or role change triggered coordinated access, ownership, credential, and asset actions at the intended effective time.
For each selected record, confirm it demonstrates Shows actual revocation in identity, SaaS, cloud, code, support, and privileged systems, including sessions and direct accounts relevant to the person.
For each selected record, confirm it demonstrates Shows that each assigned device, badge, key, or other company asset was returned, reassigned, locked, wiped, or otherwise securely resolved.
For each selected record, confirm it demonstrates Shows that shared passwords, keys, tokens, or other credentials known to a departing or transferred person were identified and changed when the risk required it.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.