Community Library

ISO 27001 Offboarding Checklist

What to do on the last day, and what to confirm after they are gone.

Join to save this for later.

A person who leaves can still reach company information until the access, the device, and the copies are closed. Give this list to the people who close that out. Each step also names the proof your ISO/IEC 27001 program should already be able to show.

How to use this checklist

1. Use this when someone leaves. Work the parts in order: the last day, the access, the equipment and information, and the check after they are gone.
2. The Proof line is the record your program keeps. If you cannot produce it, the task is not done.
3. References point to ISO/IEC 27001:2022 Annex A controls, for example A.6.5.

• 3Last day
• 4Access
• 4Equipment
• 4After they leave

15 tasks for a person who is leaving. Each one names the proof to keep and the ISO/IEC 27001:2022 control it supports.

Last day · The last day

The day they leave

The people who grant access know the last day, the work has a new owner, and confidentiality continues.

0 of 3

• Tell the people who grant access that the person is leaving, and the last working day.

  Proof: Notice with the last day and the date it was sent.

  A.6.5
• Name who receives the work, and hand it over before access ends.

  Proof: Handover note naming the person who receives the work.

  A.5.14, A.6.5
• Remind them which information stays with the company, and that confidentiality continues.

  Proof: Reminder dated on the last day, and the confidentiality agreement still on file.

  A.6.6, A.5.10

Access · Same day

Access

Ordinary access, privileged access, and the identity itself stop when the person stops.

0 of 4

• Remove ordinary access on the last day, or sooner if the departure is immediate.

  Proof: Access removal record with the accounts and the date.

  A.5.18, A.5.16
• Remove privileged access first, and change any shared secret they knew.

  Proof: Privileged access removal, and the shared secret change.

  A.8.2, A.5.17
• Disable the company identity so it cannot sign in.

  Proof: Identity marked disabled, with the date.

  A.5.16
• Check shared mailboxes, shared logins, and vendor accounts that were in their name.

  Proof: Review of shared and external access tied to the person.

  A.5.15, A.5.18

Equipment · What comes back

Equipment and information

Devices, badges, paper, and copies come back, or they are removed the approved way.

0 of 4

• Collect the company device, badge, keys, and removable media.

  Proof: Return of assets record listing what came back.

  A.5.11, A.8.1
• Remove company information from any personal device that was allowed to hold it.

  Proof: Confirmation the copies were removed, or the device was wiped.

  A.8.10, A.5.10
• Put returned media back in the controlled place, or dispose of it the approved way.

  Proof: Media record or disposal record.

  A.7.10, A.7.14
• Take back paper records and tokens.

  Proof: Those items listed on the return of assets record.

  A.5.11

After · After they leave

After they are gone

Someone confirms the person is closed out, and the records stay where the program can find them.

0 of 4

• A manager confirms the person can no longer reach company systems.

  Proof: Check dated after the last day, with the result.

  A.5.18
• Keep the agreements and the return record for as long as the program requires.

  Proof: The records stored with a retention date.

  A.5.33, A.6.5
• If access is still open, treat it as an incident and remove it.

  Proof: Incident record if access was found after the last day, or a note that none was found.

  A.5.24, A.5.18
• Record what the next leaver should do differently, if this one found a gap.

  Proof: Lesson on the leaver record.

  A.5.27

Want a leaver to close in the program, not in someone's memory?

Trygg keeps the access removal, the returned assets, and the proof in one place.

Book a demoISO 27001 Preparation Checklist

Portal demos follow a mutual NDA.

This checklist is guidance, not a substitute for the ISO/IEC 27001:2022 standard. Purchase the standard from ISO or your national standards body. Certification decisions are made only by accredited certification bodies.