ISO 27001 Offboarding: The Complete 2026 Guide

ISO 27001 offboarding is the one process every ISMS has on paper and almost none can evidence end to end. HR treats it as a payroll task, IT treats it as a ticket, and the certification auditor treats it as a control test with a sampling plan. Annex A 6.5 does not ask you to switch off a mailbox. It asks you to define, enforce and communicate the information security duties that remain in force after someone’s last day — and to do the same when a person simply moves to a different role inside the business.

That second half is where most programmes come apart. This guide covers what ISO 27001 offboarding requires under ISO/IEC 27001:2022, the Annex A controls that carry it, a leaver and mover checklist with owners and deadlines, which obligations actually survive the final day, and the evidence an auditor will ask to see.

What ISO 27001 Offboarding Actually Requires

The requirement sits in Annex A control 6.5, Responsibilities after termination or change of employment. In substance it says that the information security responsibilities and duties which stay valid after employment ends or changes must be defined, enforced and communicated to the people concerned and to other interested parties. The purpose statement in ISO/IEC 27002:2022 is about protecting the organization’s interests while employment or a contract is being changed or ended.

Reduced to its two jobs, ISO 27001 offboarding has to close down everything the person can reach and keep alive everything they still owe you. Three things in the control text are worth slowing down on.

“Defined” means written before you need it. The duties have to exist as a stated set, not as something a manager improvises during an exit conversation. In practice that is a short clause in the contract plus a line in the offboarding procedure, not a separate policy.

“Enforced” is the verb that bites. You can only enforce an obligation you created at hire. A confidentiality reminder invented on the last day has no legal footing. This is why A.6.5 is unimplementable on its own — it depends on A.6.2 (terms and conditions of employment) and A.6.6 (confidentiality or non-disclosure agreements) having been done properly at the start of the relationship. Auditors who understand the control will ask for the hire-date contract, not the exit letter.

“Communicated to relevant personnel and other interested parties” reaches past the leaver. Customers, contractors and third parties who dealt with the departing person may need to be told that the arrangement has changed, so that nobody keeps accepting instructions from someone who no longer works for you. ISO/IEC 27002:2022 also notes that where the person is a contractor, the termination process may be run by the agency responsible for them — which means your supplier agreements have to carry the obligation forward.

A.6.5 is not one of the eleven controls introduced in the 2022 edition. It carries over from A.7.3.1 in ISO/IEC 27001:2013, so a transitioned ISMS should already have something behind it. The edition itself is confirmed on ISO’s own page for ISO/IEC 27001:2022 — edition 3, published October 2022, with one amendment.

The Five Annex A Controls That Carry Offboarding

No single control covers the whole process. ISO 27001 offboarding is assembled from three controls that do the work and two that make them enforceable. Mapping them before you write the procedure stops you from arguing about scope in the audit.

Control	Title	What it contributes to offboarding	2013 origin
A.6.5	Responsibilities after termination or change of employment	The duties that survive the last day, and the duty to communicate them	A.7.3.1
A.5.11	Return of assets	Recovery of equipment, media, documents and information in any form	A.8.1.4
A.5.18	Access rights	Removal of access on termination and adjustment of access on role change	A.9.2.2, A.9.2.5, A.9.2.6
A.6.2	Terms and conditions of employment	The contractual hook that makes A.6.5 enforceable	A.7.1.2
A.6.6	Confidentiality or non-disclosure agreements	The surviving confidentiality duty and its defined period	A.13.2.4

A.6.4, the disciplinary process, sits alongside rather than inside this set. It applies to violations; A.6.5 applies to departures. An involuntary exit can trigger both, which is a reason to classify departures at the point of notice rather than treat every leaver identically. For the wider picture of how these fit the four themes, see our guide to the ISO 27001 Annex A controls.

The Mover Problem Most ISO 27001 Offboarding Checklists Miss

Read the control title again: termination or change of employment. The internal mover is in scope, and almost every ISO 27001 offboarding checklist published online ignores them completely. That is the single most common finding in this area.

ISO/IEC 27002:2022’s guidance for 6.5 is explicit about how to handle it: a change of responsibility should be managed as the termination of the responsibility that is ending combined with the initiation of the new one. Two events, not one. A mover is an ISO 27001 offboarding event in its own right, not a provisioning ticket with extra steps. And A.5.18 is built the same way — access rights are removed on termination of employment and adjusted on change of role, where “adjusted” has to mean subtraction as well as addition.

What organisations actually do is append. Someone moves from support to finance, their new permissions are granted, and nobody ever takes the old ticketing and customer-data access away. Five years and three moves later that account can reach everything, and the person holding it has no idea. The access review catches it eventually; a correctly built mover process would never have created it. If you are relying on periodic review to clean this up, read our guide to the user access review and note how much of its workload is actually uncleared mover debt.

NIST’s catalogue makes the split visible in a way ISO does not. In NIST SP 800-53 Rev. 5, termination is PS-4 and transfer is PS-5 — two separate controls, each with its own organisation-defined time period. ISO folds both into one control title, and a team reading quickly implements half of it. If your Statement of Applicability justification for A.6.5 talks only about leavers, you have documented the gap yourself.

ISO 27001 Offboarding Checklist: 12 Steps With Owners and Deadlines

ISO 27001 states no timeframe anywhere for revoking access — not in Annex A, not in 27002’s guidance. You set the clock; the control is that you meet the clock you set. The deadlines below are typical of what certification bodies see accepted, not requirements of the standard. Use the table as the spine of your ISO 27001 offboarding procedure and change the numbers to ones you can actually hit.

#	Step	Owner	Typical deadline	Evidence
1	Notify IT and security that a departure or role change is confirmed	HR	Within 1 business day of notice	Dated ticket or workflow record
2	Classify the departure: voluntary, involuntary, or elevated risk	HR with line manager	At notice	Classification field on the record
3	Issue the written reminder of surviving obligations and obtain signature	HR	Before the last working day	Signed exit acknowledgement
4	Hold the exit security briefing	Line manager	Final week	Briefing record or agenda sign-off
5	Hand over data ownership: risk owners, asset owners, approvals, shared drives	Line manager	Before the last working day	Updated asset and risk registers
6	Revoke privileged, administrative and remote access	IT	Immediately for elevated-risk exits, otherwise at end of last working day	Timestamped deprovisioning log
7	Revoke standard application and SaaS access, including tools IT did not procure	IT	End of last working day	Per-system removal record
8	Rotate shared, service and vendor-portal credentials the person knew	IT	Within 1 business day of exit	Credential rotation record
9	Revoke and collect physical access: badges, fobs, keys, parking, lockers	Facilities	Last working day	Badge system log and receipt
10	Recover assets: laptop, phone, tokens, removable media, paper files	IT asset owner	Last working day, or an agreed return date for remote staff	Signed asset return form against the inventory
11	Deal with copies on personal devices and personal cloud accounts	IT	Last working day	Attestation plus device wipe or container removal record
12	Reconcile the HR leaver and mover list against the access removal log	Information security	Monthly, or within 5 business days of each exit	Reconciliation record with exceptions closed

Step 12 is the control. Steps 1 to 11 are a procedure, and a procedure is only documentation until something independently proves it ran every time. If you build one thing from this list, build the reconciliation — it is the artefact that converts an ISO 27001 offboarding process from a claim into evidence.

Remote and hybrid staff change the shape of steps 9 to 11 rather than removing them. A courier-returned laptop with a tracked delivery receipt is accepted evidence; “they said they posted it” is not. Our guide to ISO 27001 remote working covers the asset-custody side in more depth.

Which Obligations Survive the Last Day

A.6.5 requires you to say which duties remain valid. Most organisations have never written that list down, which makes the exit acknowledgement vague and the obligation hard to enforce. The durations below are typical commercial practice, not positions of the standard, and enforceability varies considerably between jurisdictions — have the clauses reviewed by a lawyer qualified where your staff are employed.

Surviving obligation	Where it comes from	Typical duration	What makes it enforceable
Confidentiality of information learned in the role	Employment contract plus NDA (A.6.2, A.6.6)	A defined period, commonly 2 to 5 years; indefinite for trade secrets	Signed at hire, with a stated period and a defined scope of information
Assignment of intellectual property created in the role	Employment contract (A.6.2)	Permanent	Clause present from the start date
Return of all organisational information in any form	A.5.11	Immediate and continuing	Signed return form referencing the asset inventory
No further use of credentials, systems or data	Acceptable use policy accepted at hire	Permanent	Dated acceptance record, re-stated at exit
Cooperation with investigations and incident enquiries	Employment contract	A defined period after exit	Explicit clause; cannot be imposed later
Non-solicitation or restraint of trade	Employment contract, where lawful	Jurisdiction-limited, often 6 to 12 months	Local legal review; unenforceable in some jurisdictions

Two of these touch other controls directly. Intellectual property sits with A.5.32, covered in our guide to ISO 27001 intellectual property rights, and the no-further-use undertaking is only as strong as the policy the person accepted — see ISO 27001 acceptable use policy for how that acceptance should be recorded.

ISO 27001 Offboarding Evidence Your Auditor Will Ask For

Every piece of ISO 27001 offboarding evidence that an auditor accepts has a date on it, and that is the quickest test of whether yours will hold. Stage 2 auditors sample this control rather than read your procedure. Expect something close to: give me your leaver and mover list for the last six months, I will pick four, and show me each one end to end. Have these ready.

• The HR leaver and mover list for the audit period, with dates of notice and last working day. This is the population the sample is drawn from, so if it is incomplete every downstream record looks fine while the control has failed.
• Timestamped deprovisioning records per system, not a single “account disabled” flag in the directory. SaaS applications outside single sign-on need their own evidence.
• Signed exit acknowledgements showing the surviving obligations that were communicated, and who communicated them.
• Asset return forms reconciled against the inventory, including items not returned and what was done about them.
• The reconciliation record from step 12, with exceptions and their closure.
• At least one mover traced end to end, showing what access was removed, not just what was granted. Auditors increasingly ask for this specifically.
• The contractor path, evidenced through the agency or supplier where they run the process on your behalf.

The nonconformity to expect, if there is one, is a reconciliation gap: an account that stayed live for weeks after the last working day, or a mover whose old permissions were never withdrawn. Both are closable with a dated record and a corrected process, so find them yourself first.

How ISO 27001 Offboarding Maps to NIST SP 800-53

If you also report against NIST SP 800-53 Rev. 5 — or you are answering a customer security questionnaire written from it — the mapping is close enough to run one process and evidence both. NIST is more prescriptive in two places that are worth copying even if you never claim the control.

ISO 27001:2022	NIST SP 800-53 Rev. 5	What NIST adds
A.5.18 (removal on termination)	PS-4a, PS-4b	Access disabled within an organisation-defined time period, and authenticators and credentials explicitly revoked
A.6.5 (communicating surviving duties)	PS-4c	An exit interview covering organisation-defined security topics, as a named step
A.5.11 (return of assets)	PS-4d	Retrieval of all security-related system property
No direct equivalent	PS-4e	Retaining access to information and systems the leaver formerly controlled
A.5.18 (adjustment on change of role)	PS-5	A separate control for transfers: confirm the operational need for current access, modify it, and notify within a defined period

PS-4e is the one worth stealing outright. It says keep access to what the person controlled — and the instinct during ISO 27001 offboarding is the opposite, to delete the mailbox and reclaim the licence. Deleting it can destroy records you are obliged to retain, break an in-flight investigation, and strand the only copy of a document someone still needs. Disable the account, preserve the data under your retention schedule, and release the licence afterwards. Deletion when the retention period expires belongs to a different control — see ISO 27001 secure disposal.

Common ISO 27001 Offboarding Mistakes

These are the ISO 27001 offboarding failures that show up repeatedly in gap assessments.

• Treating movers as an append. New access granted, old access untouched. The fix is to run a mover as a termination plus an initiation, exactly as 27002 describes.
• Applications IT never procured. A tool bought on a team credit card has no deprovisioning path because nobody knows it exists. This is an asset inventory problem (A.5.9) surfacing as an ISO 27001 offboarding problem.
• Shared and service account passwords. Disabling a named account does nothing about the shared credential the leaver memorised. Rotation has to be a step, not an afterthought.
• No signed acknowledgement. Without it you cannot evidence that the surviving duties were communicated, which is half of what A.6.5 asks for.
• Contractors and agency staff outside the process. They are in scope; their exit is often invisible to HR because it was never an HR record.
• Deleting instead of preserving. Covered above, and the most expensive mistake on this list.
• No reconciliation. A checklist nobody audits is a document, not a control.
• Nothing triggered by a policy revision. If the obligations change, the people already gone were told the old version — which is an argument for keeping the surviving duties in the contract rather than only in a policy.

Most of these are process design faults rather than tooling faults, and none of them need a new platform to fix. They do need someone to own the reconciliation, which is usually the step nobody has been given.

ISO 27001 Offboarding FAQ

Is an ISO 27001 offboarding policy a mandatory document?

No. Clause 7.5 mandates a specific set of documented information and this is not on it — see our list of ISO 27001 mandatory documents. A.6.5 says the surviving duties must be defined, enforced and communicated, and it does not use the phrase “available as documented information”. In practice you still need something written, because “defined” and “communicated” are both hard to evidence verbally, but it can live inside an existing HR procedure rather than as a standalone policy.

How quickly does ISO 27001 require access to be revoked?

The standard sets no deadline. Neither does ISO/IEC 27002:2022, which talks about timeliness without putting a number on it. You define the target and the audit tests whether you hit it. Common targets are immediate revocation for privileged and elevated-risk cases, end of the last working day for standard accounts, and a reconciliation within five business days. Any defensible number you actually meet beats an aggressive number you miss, and an ISO 27001 offboarding target of two business days that is always met is stronger evidence than a four-hour target that is not.

Does ISO 27001 offboarding apply to contractors and temporary staff?

Yes. A.6.5 reaches relevant personnel and other interested parties, and ISO/IEC 27002:2022 notes that for a contractor the process may be carried out by the agency responsible for them. Outsourcing the mechanics of ISO 27001 offboarding is allowed; outsourcing the accountability is not. That does not transfer the obligation — it means your supplier and agency agreements have to require it and you have to be able to show evidence from them.

What is the difference between A.6.4 and A.6.5?

A.6.4 is the disciplinary process and applies when someone breaches the rules while employed. A.6.5 is about the duties that outlive the employment relationship. An involuntary termination may invoke both, and the sequencing matters: the disciplinary record is evidence for A.6.4, and the signed acknowledgement of surviving duties is evidence for A.6.5.

Should a departing employee’s accounts and data be deleted?

Disable the account, preserve the data. Deletion is governed by your retention schedule and by any legal hold, not by the exit date. PS-4e in NIST SP 800-53 states the requirement plainly — retain access to the information the person formerly controlled — and it is sound practice under ISO 27001 even though Annex A does not say it in those words.

Who should own the ISO 27001 offboarding process?

HR owns the trigger and the acknowledgement, IT owns deprovisioning and asset recovery, the line manager owns handover and the exit briefing, and information security owns the reconciliation. Written down that way, the control has four named owners and no gaps. Written down as “HR offboards leavers”, it has one owner who cannot perform most of the steps, and that single-owner model is the root cause of most failed ISO 27001 offboarding audits. Role clarity here is also what makes the awareness side work — see ISO 27001 security awareness training.

Getting ISO 27001 Offboarding Ready for Audit

Build it in this order: contract clauses first, because nothing downstream is enforceable without them; then the mover path, because it is the gap your auditor will probe; then the reconciliation, because it is the only part that generates evidence on its own. The checklist comes last and is the easiest piece. A functioning ISO 27001 offboarding process is roughly two pages of procedure, one acknowledgement form, one asset return form and a monthly reconciliation — not a platform purchase.

Our ISO 27001 Toolkit provides 165 templates mapped to ISO/IEC 27001:2022, including the HR security procedure, asset return and exit acknowledgement forms, the access control and asset management policies these steps reference, and the Statement of Applicability where A.6.5, A.5.11 and A.5.18 have to be justified. It is $99 as a one-time purchase, with lifetime updates and no subscription.