SECURITY
Offboarding is a security control
5 min read
Offboarding counts as a security control only when the organisation can produce evidence that a specific person’s access ended on a specific date, which is a different and harder standard than having a checklist that someone followed.
Most organisations have an offboarding process. Far fewer can answer the question an auditor, an insurer or an incident responder will actually ask: show me that this person's access ended, and when.
The gap between those two is the difference between a procedure and a control. A procedure describes what should happen. A control produces evidence that it did.
Why evidence rather than process
A checklist that someone ticks is evidence that a box was ticked. It is not evidence that the session was revoked, the device was wiped, or the third-party account was closed, and after an incident the distinction becomes the whole conversation.
Evidence means artefacts the system produced: the audit log entry showing session revocation, the device record showing the wipe completed, the export from the third-party tool showing the account disabled, each with a timestamp.
The access that is not in your directory
Directory offboarding handles the accounts you provision. It does not touch the ones people created themselves or that live outside the identity provider, and that is where most residual access survives.
This list is almost never complete at the point of departure, which is why it needs to be maintained during employment rather than reconstructed at the end.
- SaaS tools bought on a department card and never brought behind single sign-on
- Shared credentials in a team password vault, which do not expire when a person leaves
- API keys, personal access tokens and app registrations created by the individual
- Access to customer or partner systems granted directly to the person, not the company
- Physical access: building passes, keys, and anything connected to them
Contractors and the access that nobody owns
Permanent staff leave through HR, which generates a trigger. Contractors, agency staff, vendors and project consultants frequently do not, because the engagement ends by a contract date passing rather than by anyone filing a leaver.
The reliable mechanism is an expiry date on the account set at creation, matched to the engagement end, with extension requiring a deliberate action. An account that has to be renewed fails safe; an account that has to be remembered does not.
Test the control
Controls that are never tested are assumptions. The test is straightforward: pick three people who left in the last quarter and attempt to find any surviving access for them, across the directory, the SaaS inventory, the vault and the third-party systems.
The result is either reassuring or it is the most valuable thing you will learn that quarter. Either way it should be documented and repeated, because it is the only way to know whether the process still works after the people who designed it moved on.
The measure worth reporting
Not the number of leavers processed. Time from departure date to fully revoked access, and the number of accounts found active after their owner left.
The second number should trend to zero and will not get there by itself. It gets there because someone looks for it on a schedule.
Questions we get asked
Is offboarding really a significant risk compared with external attacks?
Residual access after departure is attractive for a specific reason: it is legitimate. Credentials that still work generate no alerts, bypass controls designed for outsiders, and may belong to someone with knowledge of where the valuable data is. The volume is lower than external attacks and the per-incident cost tends not to be.
How should contractor accounts be handled differently?
Set an expiry date at creation that matches the engagement end, so extending access requires a deliberate decision. This removes dependence on anyone remembering to raise a leaver for someone who was never in the HR system.
How often should we review for accounts belonging to people who have left?
Quarterly is a reasonable cadence for most organisations, with the review covering the SaaS and third-party inventory as well as the directory. Monthly is worth it where turnover is high or where contractors make up a large share of the workforce.