ISO 27001 A.6.5: Responsibilities After Termination or Change of Employment

Quick Reference (60 Seconds)

What the Control Asks For

Do you need this control?

A.6.5 is not mandatory in itself: under clause 6.1.3 you include it if your risk assessment calls for it, and record the decision in your Statement of Applicability. Almost every organisation with leavers or role changes includes it. It works with A.5.11 (return of assets) and A.5.18 (access rights), so many organisations implement all three through one joiner-mover-leaver process.

The Control in Brief

Annex A 6.5 asks organizations to define, enforce and communicate to the relevant personnel and other interested parties the information security responsibilities and duties that remain valid after termination or change of employment.

Implementation Guidance (ISO 27002:2022, paraphrased)

• Define which security responsibilities remain valid after termination or change: confidentiality of information, intellectual property and other knowledge obtained, and duties in any other confidentiality agreement (A.6.6)
• Put continuing duties in the person's terms and conditions of employment (A.6.2), contract or agreement; other agreements that run for a defined period after employment can also carry security duties
• Manage a change of role as the termination of the current role plus the start of the new one
• Identify and transfer the security roles and responsibilities held by the leaver or mover to someone else
• Communicate the change, and any change to operating procedures, to personnel, other interested parties and relevant contacts (for example customers and suppliers)
• Apply the same process to external personnel (contractors, supplier staff)

Returning assets (A.5.11) and removing or adjusting access (A.5.18) happen in the same exit process; this guide covers them alongside A.6.5.

"Shall" vs "Should" Analysis

• Shall (once you have selected this control): post-employment obligations are defined, communicated and enforced
• Should: Specific obligations, methods, and enforcement mechanisms are flexible based on context

Common Misinterpretations

Why Termination Responsibilities Matter

The Business Risk Narrative

Post-employment security failures are a major source of data breaches and insider threats:

• A 2013 Symantec and Ponemon Institute survey found that about half of employees who left or lost their jobs kept confidential corporate data
• Accounts left active after exit, and shared passwords that are never changed, are a recurring audit finding
• DPDP Act 2023: Organizations must delete personal data when purpose is fulfilled; retention of ex-employee data must be justified

Regulatory Landscape in India

Industry-Specific Consequences

Scope and Applicability

What the Control Covers

• Termination exit procedures: Voluntary resignation, involuntary termination, retirement, end of contract, death, disability
• Role change procedures: Promotion, demotion, transfer, lateral move, temporary assignment, return from leave
• Asset return: All organizational assets (devices, data, documents, credentials, access cards, keys)
• Access revocation: All system access, accounts, privileges, VPN, remote access, cloud access
• Post-employment obligations: NDA and confidentiality, IP assignment, reasonable non-solicitation (post-employment non-competes are void in India under s.27 of the Indian Contract Act)
• Data obligations: Deletion of organizational data from personal devices and accounts
• Exit interviews: Security-focused exit interviews and compliance reminders
• Communication: Reminding departing employees of continuing obligations
• Enforcement: Legal remedies when there is evidence of a breach of continuing obligations
• Full and final settlement: wages due on exit are paid within two working days (Code on Wages s.17(2)); exit security steps are finished by the last working day, not used to hold back pay
• After exit: Checking internal systems for use of old credentials and forwarding rules; acting on evidence of misuse
• Data retention: Managing ex-employee data under DPDP requirements
• Knowledge transfer: Ensuring continuity of critical knowledge and access

Who It Applies To

What It Does NOT Cover

• General HR exit procedures (payroll, benefits, gratuity), covered by HR
• Labor dispute resolution, covered by Legal and labor law
• Criminal prosecution for data theft, covered by Law Enforcement
• Civil litigation for breach of contract, covered by Legal
• General employee onboarding, covered by HR (though role change is covered here)

Size-Based Applicability

Key Definitions and Terminology

Relationship to Other Controls

Upstream Controls (Prerequisites)

Downstream Controls (Enabled By)

Parallel Controls (Work Alongside)

Implementation Roadmap (Week-by-Week)

Phase 1: Discovery & Assessment (Weeks 1-2)

Week 1: Current Exit Process Assessment

• Deliverable: Current exit process maturity assessment
• Owner: HR + CISO + IT + Legal
• Activities:
  1. Map current exit process (what happens when someone resigns or is terminated)
  2. Assess access revocation process (how long, how thorough, what systems)
  3. Assess asset return process (what assets, how tracked, how verified)
  4. Review past exits for security gaps (unreturned assets, lingering access, data breaches)
  5. Assess NDA and post-employment obligations in contracts
  6. Interview departing employees about exit experience (recent exits)
  7. Assess exit interview process (security focus, obligation reminder)
  8. Review the exit timeline so security checks finish within the notice period (pay is due within two working days of exit)
  9. Assess post-employment monitoring (any detection of violations)
  10. Benchmark against industry practices and ISO 27001 requirements

Week 2: Risk and Gap Analysis

• Deliverable: Exit security gap analysis report
• Owner: HR + CISO + IT + Legal + Compliance
• Activities:
  1. Map all systems and access that departing employees have
  2. Identify systems where access is not revoked promptly
  3. Identify unreturned assets from past exits
  4. Identify ex-employees with lingering access
  5. Assess data exfiltration risk (DLP, logs, monitoring)
  6. Map contractual obligations (NDA, IP, non-solicitation) and their enforceability
  7. Assess DPDP compliance for ex-employee data retention
  8. Identify role change gaps (access not adjusted on promotion/transfer)
  9. Define target state for exit security maturity
  10. Create gap closure plan

Phase 2: Design & Planning (Weeks 3-4)

Week 3: Exit Procedure Design

• Deliverable: Draft Exit Security Procedure + Checklists + Templates
• Owner: HR + CISO + IT + Legal
• Activities:
  1. Design exit trigger process (resignation, termination, contract end, role change)
  2. Design notice period security management (access restriction during notice period)
  3. Create exit security checklist (access, assets, data, obligations)
  4. Design access revocation workflow (what systems, timeline, verification)
  5. Design asset return workflow (inventory, collection, verification, reassignment)
  6. Design data deletion verification (personal devices, cloud accounts, email)
  7. Design exit interview process (security focus, obligation reminder, feedback)
  8. Design the exit workflow so security checks finish by the last working day
  9. Design post-employment monitoring process (detection, investigation, enforcement)
  10. Design role change procedure (access adjustment, asset reassignment, training)
  11. Create documentation templates (exit checklist, clearance certificate, NDA reminder)
  12. Design automation for access revocation and asset tracking

Week 4: Contract and Legal Framework Design

• Deliverable: Contract Templates + Legal Enforcement Framework + DPDP Compliance Plan
• Owner: Legal + HR + CISO
• Activities:
  1. Review existing employment contracts for post-employment obligations
  2. Draft NDA addendum for existing employees without adequate NDA
  3. Draft IP assignment clause for employment contracts
  4. Draft confidentiality and non-solicitation clauses (do not rely on post-employment non-competes, which are void under s.27)
  5. Draft non-solicitation clause for customers and employees
  6. Draft data deletion obligation clause
  7. Draft post-employment monitoring consent clause (within DPDP limits)
  8. Create legal enforcement framework (breach notice, litigation, injunction)
  9. Design DPDP compliance for ex-employee data (retention, deletion, justification)
  10. Create settlement agreement template with security terms
  11. Design garden leave policy for critical roles (BFSI, senior execs)
  12. Review for compliance with Indian labor law (Industrial Relations Code, notice period, Code on Wages s.17(2), gratuity under the Code on Social Security)

Phase 3: Implementation (Weeks 5-8)

Week 5: Contract Rollout

• Deliverable: All employees have post-employment obligations in contracts
• Owner: HR + Legal
• Activities:
  1. Roll out NDA addendum to all employees without adequate NDA
  2. Update employment contracts for new hires with complete post-employment clauses
  3. Obtain signed acknowledgments from all employees
  4. Track completion rate (target: 100%)
  5. Create contract repository with version control
  6. Train managers on new contract requirements
  7. Create employee FAQ on post-employment obligations

Week 6: Exit Procedure Implementation

• Deliverable: Exit procedure operational for all exits
• Owner: HR + CISO + IT
• Activities:
  1. Publish formal exit security procedure
  2. Create exit security checklist (paper or digital)
  3. Implement access revocation workflow (manual or automated)
  4. Create asset return process with verification
  5. Create data deletion verification process
  6. Implement exit interview with security focus
  7. Create an exit clearance record
  8. Schedule exit checks within the notice period (do not link them to payment of wages)
  9. Train HR and managers on exit procedure
  10. Process first exit with new procedure (test case)

Week 7: Automation and Tools

• Deliverable: Automated access revocation and asset tracking operational
• Owner: IT + CISO + HR
• Activities:
  1. Configure automatic access revocation in IAM/AD upon HR trigger
  2. Integrate HRIS with IT ticketing for exit notifications
  3. Implement asset tracking system (barcode/RFID)
  4. Configure DLP monitoring for departing employees (30-day pre-exit monitoring)
  5. Set up post-employment monitoring alerts (email forwarding, account access attempts)
  6. Create automated exit report (all access revoked, assets returned, clearance status)
  7. Test automation with mock exit scenario
  8. Train IT staff on automated exit workflow

Week 8: Role Change Procedure Implementation

• Deliverable: Role change security procedure operational
• Owner: HR + CISO + IT
• Activities:
  1. Create role change security checklist (access removal, access addition, training)
  2. Implement role change trigger in HRIS (promotion, transfer, lateral move)
  3. Create role-based access control (RBAC) matrix for role changes
  4. Implement automated access adjustment upon role change
  5. Create asset reassignment process (return old, receive new)
  6. Implement role change training requirement (security training for new role)
  7. Create role change documentation template
  8. Test with first role change

Phase 4: Testing & Validation (Weeks 9-10)

Week 9: Process Testing

• Deliverable: Process validation report with mock scenarios
• Owner: HR + Internal Audit + CISO + IT
• Activities:
  1. Test voluntary resignation exit (full procedure)
  2. Test involuntary termination exit (rapid procedure)
  3. Test role change (promotion with access change)
  4. Test contract end exit (temporary staff)
  5. Test remote worker exit (home device return)
  6. Test access revocation verification (all systems checked)
  7. Test asset return verification (all assets accounted for)
  8. Test data deletion verification (personal device scan)
  9. Test exit interview process (security questions, obligation reminder)
  10. Test that exit checks complete by the last working day
  11. Test post-employment monitoring (detection of violations)

Week 10: Compliance and Audit Validation

• Deliverable: Compliance validation report
• Owner: Legal + Compliance Manager + HR
• Activities:
  1. Validate contract enforceability (Legal review)
  2. Verify DPDP compliance for ex-employee data handling
  3. Verify labor law compliance (notice period, gratuity, full and final settlement)
  4. Test NDA enforcement mechanism (breach notice template)
  5. Verify access revocation for all past exits (last 90 days)
  6. Verify asset return for all past exits (last 90 days)
  7. Verify exit interview completion rate
  8. Verify clearance certificate issuance rate
  9. Prepare compliance evidence package
  10. Conduct internal audit of exit security procedure

Phase 5: Documentation & Certification Prep (Weeks 11-12)

Week 11: Documentation

• Deliverable: Complete exit security documentation
• Owner: HR + Compliance Manager
• Activities:
  1. Document all policies, procedures, and checklists
  2. Create illustrative scenarios and examples (anonymized)
  3. Create training materials for managers and HR
  4. Create employee FAQ on exit security
  5. Create metrics dashboard and reporting templates
  6. Create evidence repository for audits
  7. Document automation configuration and workflows

Week 12: Certification Readiness

• Deliverable: Audit-ready evidence package
• Owner: CISO + Compliance Manager
• Activities:
  1. Conduct internal audit of exit security procedure
  2. Prepare evidence for external ISO 27001 auditor
  3. Remediate any gaps found
  4. Conduct management review
  5. Present program to certification body

Detailed Implementation Guidance

Step-by-Step Implementation

Step 1: Define Exit Triggers

Step 2: Create Exit Security Checklist

Access Revocation Checklist:

• Active Directory / LDAP account disabled
• Email account disabled or forwarded (with monitoring)
• VPN access revoked
• Remote desktop access revoked
• Cloud accounts (AWS, Azure, GCP) access revoked
• SaaS application access revoked (CRM, ERP, HRIS, etc.)
• Database access revoked
• Code repository access revoked (GitHub, GitLab, Bitbucket)
• CI/CD pipeline access revoked
• Monitoring and admin tool access revoked
• Wi-Fi access revoked
• Physical access card deactivated
• Parking pass collected
• Biometric access deactivated
• Security alarm codes changed
• Shared accounts password changed (if employee knew them)
• API keys and tokens revoked
• SSH keys removed from servers
• SSL certificates and encryption keys transferred
• Mobile device management (MDM) account wiped/removed
• Collaboration tools (Slack, Teams, Confluence) access revoked
• Social media admin access revoked (if applicable)
• Customer portal admin access revoked
• Vendor portal access revoked
• Third-party service access revoked (where employee was admin)

Asset Return Checklist:

• Laptop/desktop returned
• Mobile phone/tablet returned
• Monitor(s) returned
• Keyboard, mouse, docking station returned
• External hard drives returned
• USB drives returned
• Access card returned
• ID badge returned
• Keys returned (office, server room, cabinet, safe)
• Company vehicle returned (if applicable)
• Company credit card returned
• Security tokens, smart cards, RSA tokens returned
• Printed documents returned (or securely destroyed)
• Company data on personal devices verified deleted
• Cloud storage (personal accounts) verified no company data
• Email forwarding rules removed (if any were set up)
• Personal belongings cleared from workspace
• Home office equipment returned (if remote worker)
• Customer gifts, samples, promotional materials returned
• Proprietary tools, software licenses returned
• Uniforms, safety equipment returned (if applicable)

Data and Security Checklist:

• Data backup from employee devices completed
• Device wiped and reimaged (if returning to asset pool)
• Forensic image taken (if termination for cause)
• Email archive preserved for legal/compliance
• Personal data on company devices identified and separated
• DLP scan of recent activity (30-90 days pre-exit)
• Log review for suspicious activity (30-90 days pre-exit)
• Customer data handling verified (no unauthorized copies)
• IP and code repository access verified revoked
• Confidential documents verified not in personal email/cloud
• Social media posts reviewed (no confidential information shared)
• Personal accounts used for work (Shadow IT) identified and addressed
• Collaboration tool content (Slack, Teams) archived
• Project files and knowledge documents transferred
• Password manager access revoked (company vault)

Obligations Reminder Checklist:

• NDA obligations explained and signed acknowledgment
• IP assignment obligations explained
• Confidentiality and non-solicitation obligations explained
• Non-solicitation obligations explained (customers and employees)
• Non-disparagement obligations explained
• Data deletion obligations explained (personal devices)
• Return of confidential information obligations explained
• Continuing cooperation obligations explained (if applicable)
• Legal consequences of breach explained
• Contact information for legal/HR provided for questions
• Signed exit acknowledgment form obtained

Full and Final Settlement Checklist:

• Exit security checklist complete by the last working day
• Outstanding dues calculated
• Asset recovery costs calculated (if unreturned)
• Gratuity processed (if applicable)
• PF/ESI processed
• Tax documents (Form 16) provided
• Relieving letter issued
• Experience certificate issued
• Reference contact provided (if positive reference)
• Settlement agreement signed (if applicable)
• Final payment processed
• Exit survey completed (optional)

Step 3: Implement Access Revocation

Timeline for Access Revocation:

Access Revocation Process:

1. HR triggers exit in HRIS (resignation date, termination date, role change date)
2. HRIS auto-generates IT ticket for access revocation
3. IT disables access in identity management system (AD, LDAP, SSO)
4. IT revokes access in all connected systems (automated or manual)
5. IT verifies revocation (test login attempts, review access logs)
6. Security team reviews logs for recent suspicious activity (30-90 days)
7. IT updates asset inventory (device assignment removed)
8. Facilities deactivates physical access
9. HR verifies all revocations complete before clearance certificate

Step 4: Implement Asset Return

Asset Return Process:

1. HR notifies employee of asset return requirements upon resignation/termination
2. Employee returns all assets to IT/Admin on last working day
3. IT/Admin verifies asset condition and functionality
4. IT/Admin updates asset inventory (returned, condition noted)
5. IT wipes data from devices (if returning to pool) or creates forensic image (if termination for cause)
6. IT returns personal data to employee (if found on company device)
7. Finance verifies no outstanding asset loans or charges
8. If assets are missing, HR/Finance pursues return or recovery; deductions from wages only where the Code on Wages s.18 permits, with Legal sign-off
9. Asset reassigned or disposed of per A.5.9 and A.7.14

Step 5: Implement Data Deletion Verification

Data Deletion Process:

1. Employee signs data deletion affidavit (affirming no company data on personal devices)
2. IT provides data deletion guidance (how to delete from personal devices, cloud accounts, email)
3. For high-risk exits, IT may request device scan or remote wipe (if BYOD with MDM)
4. DLP scan confirms no recent data exfiltration to personal accounts
5. Email forwarding rules checked and removed
6. Personal cloud storage (Google Drive, Dropbox) checked for company data (if employee consented to scan)
7. Leaver confirms in writing that company data has been deleted from personal devices and accounts (do not scan personal accounts)
8. (No social media checks: act only on specific evidence, with legal advice)

Step 6: Implement Exit Interview with Security Focus

Exit Interview Security Questions:

1. Do you understand that your NDA obligations continue after employment?
2. Have you returned all company assets, including devices, documents, and access cards?
3. Have you deleted all company data from your personal devices and accounts?
4. Have you removed company email access from your personal phone?
5. Do you have any company information in your personal email, cloud storage, or devices?
6. Are you aware that taking company confidential information is a breach of contract and may be illegal?
7. Have you shared any company confidential information with anyone outside the organization?
8. Do you know who to contact if you have questions about your post-employment obligations?
9. Have you been approached by anyone to share company information?
10. Do you understand your continuing confidentiality and non-solicitation obligations, whoever your next employer is?

Exit Interview Reminders:

• Remind employee of NDA obligations and legal consequences of breach
• Remind employee of IP assignment obligations
• Remind employee of non-solicitation obligations (customers and employees)
• Remind employee of data deletion obligations
• Provide contact information for legal questions
• Provide copy of NDA and relevant contract clauses
• Document that obligations were communicated and acknowledged

Step 7: Complete Exit Security Checks Without Holding Back Pay

Exit checks run during the notice period, not after it:

• Plan the exit checklist so it is complete on or before the last working day:
  • All assets returned
  • All access revoked (on the last day at the latest; immediately for high-risk exits)
  • Exit interview completed with obligation acknowledgement
  • Any security concerns (suspicious activity, data exfiltration) escalated to the CISO and Legal
• Wages due on exit must be paid within two working days of resignation, removal, dismissal or retrenchment (Code on Wages 2019, s.17(2)). Security checks are not a lawful reason to delay them.
• Deductions for unreturned or damaged assets are allowed only where the asset was expressly entrusted to the employee and the loss is attributable to their neglect or default, within the limits of the Code on Wages s.18 (total deductions are capped). Get Legal sign-off first; otherwise recover the asset or its value separately.
• Gratuity can be forfeited only on the narrow grounds in the Code on Social Security 2020, s.53(6) (for example, to the extent of damage caused by wilful omission or negligence). Provident fund cannot be withheld.
• Serious security concerns are handled through the legal enforcement route (Step 11), not by holding back statutory dues.

Step 8: Implement Post-Employment Monitoring

After-Exit Checks (internal systems only):

• Check for email forwarding rules set up before exit and remove them
• Alert on login attempts using the leaver's old credentials
• Review DLP and access logs for unusual data movement during the notice period
• Act on specific evidence of misuse (for example a customer complaint or a found document) with legal advice

General surveillance of former employees (social media, job moves, contacts) is disproportionate under the DPDP Act and is not needed for A.6.5. Post-employment non-competes are void in India, so a move to a competitor is not itself a breach.

Duration: 30 to 90 days of internal log review is usually enough; keep the period proportionate and documented.

Step 9: Implement Role Change Procedure

Role Change Security Process:

1. HR triggers role change in HRIS (old role, new role, effective date)
2. HRIS auto-generates IT ticket for access adjustment
3. IT removes access for old role (per old role access matrix)
4. IT adds access for new role (per new role access matrix)
5. IT verifies no excess access (only new role access, no old role access)
6. Employee returns old role assets (if applicable)
7. Employee receives new role assets (if applicable)
8. Employee completes security training for new role (if required)
9. Manager verifies knowledge transfer from old role
10. Security team verifies access adjustment in next review cycle

Step 10: Implement Contractual Obligations

Employment Contract Obligations:

• NDA: Employee agrees not to disclose confidential information during and after employment
• IP Assignment: Employee agrees that all work product is owned by employer
• Non-Compete: Employee agrees not to work for competitor for limited period (reasonable in scope, geography, duration, limited enforceability in India)
• Non-Solicitation: Employee agrees not to solicit customers or employees for limited period
• Non-Disparagement: Employee agrees not to disparage employer
• Data Deletion: Employee agrees to delete all company data from personal devices upon exit
• Return of Property: Employee agrees to return all company property upon exit
• Cooperation: Employee agrees to cooperate in legal proceedings (if applicable)
• Breach Penalties: Employee acknowledges legal consequences of breach (damages, injunction)

India-Specific Contract Considerations:

• Non-compete: Generally unenforceable in India for employment contracts (Section 27 of Indian Contract Act), but may be enforceable for sale of goodwill or during employment. Post-employment non-compete is usually void. Focus on non-solicitation and NDA instead.
• NDA: Enforceable for trade secrets and confidential information. Must be reasonable in scope and duration.
• IP Assignment: Enforceable for employee inventions created during employment. Must specify what is covered.
• Governing Law: Indian law; jurisdiction in Indian courts.
• Garden Leave: Valid if employer pays salary during notice period. All access can be revoked during garden leave.

Step 11: Implement Legal Enforcement

Enforcement Framework:

1. Breach Detection: Internal logs, a complaint or other specific evidence suggests a breach of continuing obligations
2. Incident first: If personal or customer data has left with the person, treat it as a security incident (A.5.24–A.5.26): contain, assess, and decide notifications now (CERT-In within 6 hours for reportable incidents; DPDP Board and affected people without delay once the Rules' breach duties apply; sector regulators as required)
3. Evidence Collection: Preserve evidence (A.5.28): logs, documents, witness statements
4. Breach Notice: Send formal breach notice to ex-employee (cease and desist, damages, legal action)
5. Settlement Negotiation: Attempt to resolve without litigation (return of information, damages, commitment)
6. Injunction: If urgent, seek court injunction to stop breach (ex-parte injunction if necessary)
7. Litigation: File civil suit for breach of contract, breach of confidence, or copyright infringement
8. Criminal Action: If theft, criminal breach of trust or cheating (BNS), IT Act offences, or Official Secrets Act violation, file a police complaint

Step 12: Implement DPDP Compliance

Ex-Employee Data Management:

• Retention: Retain ex-employee data only for legal and compliance purposes (tax, labor law, legal claims)
• Deletion: Delete personal data when legal retention period expires (with legal justification)
• Justification: Document the legal basis for retention (for example payroll records in the books of account for 8 years under Companies Act s.128(5), Labour Code registers as their rules prescribe, and limitation periods for possible claims)
• Access: Ex-employees have DPDP rights to information, correction and erasure once the Act's duties apply (about May 2027)
• Correction: Ex-employee can request correction of inaccurate personal data
• Grievance: Ex-employee can file grievance regarding their data
• Contact point: The Data Fiduciary's published contact person (s.8(9)) handles ex-employee requests; a DPO is required only for Significant Data Fiduciaries
• Security: Ex-employee data must be secured with same rigor as current employee data

Step 13: Implement Knowledge Transfer

Knowledge Transfer Process:

1. Manager identifies critical knowledge and responsibilities of departing employee
2. Manager identifies replacement or knowledge recipient
3. Departing employee documents processes, procedures, and tribal knowledge
4. Departing employee conducts handover sessions with replacement
5. Departing employee provides access to all relevant files, documents, and systems
6. Manager verifies knowledge transfer completeness
7. Documentation archived for future reference
8. Replacement trained on critical tasks before departure

Step 14: Implement Metrics and Reporting

• Track exit security clearance completion rate (target: 100%)
• Track access revocation timeline (target: <4 hours for critical, <24 hours for standard)
• Track asset return rate (target: 100%)
• Track missing assets (target: <2%)
• Track exit interview completion rate (target: 100%)
• Track post-employment monitoring alerts (trending)
• Track legal enforcement actions (trending down)
• Track role change access adjustment errors (target: <1%)
• Report quarterly to management and board
• Benchmark against industry data

Step 15: Continuous Improvement

• Annual review of exit security procedure
• Quarterly metrics review
• Annual contract review (NDA, IP, non-solicitation)
• Post-exit review of critical exits (lessons learned)
• Update for regulatory changes (DPDP, labor law, industry-specific)
• Benchmark against industry best practices
• Gather feedback from departing employees on exit process
• Update automation based on process changes
• Review and update role change access matrix
• Test post-employment monitoring effectiveness

Tools, Technologies, and Solutions

Complete Tool Comparison

Recommendations by Organization Size

Policy and Procedure Templates

Exit Security Policy (Key Sections)

Exit Security Procedure

Risk Assessment and Treatment

Key Risks Addressed by This Control

Audit and Compliance Checklist

Audit Questions (25 Questions)

Metrics and KPIs

Key Metrics Dashboard

Common Pitfalls and How to Avoid Them

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian SaaS Company, CloudSync Solutions

Company Profile:

• Size: 220 employees
• Industry: B2B SaaS, Cloud Integration Platform
• Location: Hyderabad, India
• Customers: 350 enterprise clients globally
• Regulatory Scope: DPDP Act 2023, SOC 2 Type II, ISO 27001, GDPR

Challenge: CloudSync had a serious post-employment security problem:

• When a senior developer resigned to join a competitor, his access was "revoked" but only his AD account was disabled
• His GitHub access, AWS console access, and database access were never revoked (no one knew he had them)
• He had cloned the entire source code repository to his personal GitHub account 2 weeks before resigning
• He had downloaded customer database schemas and API documentation
• He joined a direct competitor and launched a similar product in 6 months
• CloudSync discovered the product similarity and investigated
• Forensic analysis showed he had taken 80% of the source code and all API documentation
• CloudSync sued for breach of NDA and trade secret misappropriation
• The case was ongoing but legal fees had already reached
• The competitor product was eroding CloudSync's market share (15% revenue decline in 6 months)
• Customer trust was damaged; 3 major customers cited "security concerns" and churned
• The company had no formal exit procedure, no asset tracking, no DLP, no post-employment monitoring
• The employee had never signed a proper NDA (his offer letter had a vague "confidentiality" clause)
• The company had no IP assignment agreement
• There was no exit interview, no security clearance, no data deletion verification

Solution:

1. Week 1-2: Emergency Exit Procedure

   • Engaged an external security consultant for emergency exit security redesign
   • Created formal Exit Security Procedure with complete checklist
   • Implemented automated access revocation through Azure AD lifecycle management
   • Created complete access inventory (all systems, all accounts, all employees)
   • Identified 47 "forgotten" accounts that ex-employees still had access to
   • Revoked all lingering access immediately
   • Created asset inventory and tracking system

2. Week 3-4: Contract and Legal Framework

   • Drafted complete NDA for all employees (new and existing)
   • Drafted IP Assignment Agreement (all work product owned by company)
   • Drafted Non-Solicitation Agreement (customers and employees, 18 months)
   • Drafted Data Deletion Obligation Clause
   • Updated employment contracts for all new hires
   • Obtained signed NDA addendum from all 220 existing employees
   • Created legal enforcement framework (breach notice, injunction, litigation)
   • Created settlement agreement template with security terms

3. Week 5-6: DLP and Monitoring

   • Implemented Microsoft Purview DLP across all endpoints and cloud
   • Configured DLP for source code, customer data, API documentation
   • Set up 30-day pre-exit monitoring for all resignations (DLP alert on data exfiltration)
   • Implemented email forwarding rule monitoring
   • Created post-employment monitoring framework (login attempts, competitive intelligence)
   • Trained security team on DLP and monitoring tools

4. Week 7-8: Exit Procedure Implementation

   • Implemented HRIS-IT integration (BambooHR → Azure AD → IT ticket)
   • Created exit security checklist with 50+ items
   • Implemented exit interview with security focus (15 questions)
   • Created data deletion affidavit
   • Created security clearance certificate
   • Built exit security checks into the notice period
   • Created rapid exit procedure for involuntary termination
   • Processed first 5 exits with new procedure successfully

5. Week 9-12: Metrics and Legal Action

   • Created quarterly metrics dashboard
   • 100% exit interview completion achieved
   • 100% security clearance completion achieved
   • Average access revocation: 2 hours (down from 7 days)
   • Zero lingering access incidents detected
   • DLP detected 3 data exfiltration attempts during notice periods (prevented)
   • Legal team sent breach notice to the ex-developer with evidence
   • Filed for injunction to stop competitor product launch
   • Negotiated settlement with ex-developer (return of code, damages, confidentiality and non-solicitation undertakings)
   • Won 2 major customers back after demonstrating improved security

Results:

• Post-employment breaches: Zero in 6 months (vs. 1 catastrophic breach before)
• Access revocation: 100% within 4 hours (vs. 7 days before)
• Asset return: 98% (vs. 60% before)
• Lingering access: Zero detected (47 were found and revoked initially)
• DLP alerts: 3 data exfiltration attempts prevented during notice periods
• Legal risk: Breach notice sent, injunction filed, settlement reached
• Revenue: Stabilized after initial decline; won back 2 customers
• Customer trust: Restored after demonstrating exit security program
• Legal fees: for initial case; prevented future cases
• Competitive advantage: Exit security became a sales differentiator

Illustrative Scenario 2: Large BFSI, Bharat Financial Services (BFS)

Company Profile:

• Size: 6,500 employees, 5,800 frontline staff
• Industry: Retail Banking and Financial Services
• Location: Mumbai, India (branches nationwide)
• Customers: 4.2 million retail customers, 15,000 corporate clients
• Regulatory Scope: RBI, SEBI, IRDAI, DPDP Act 2023, ISO 27001, PCI DSS
• Union: Frontline staff union (strong); CBA every 3 years

Challenge: BFS had a massive post-employment risk exposure:

• Bank employees had access to customer financial data, KYC documents, loan details, and account information
• When a relationship manager left, his access was revoked "within 24 hours" but this was only the core banking system
• He still had access to 12 other systems (CRM, loan management, reporting, email, VPN) for days after exit
• He had downloaded customer KYC documents and account statements to his personal laptop
• He joined a competing bank and used the customer data to solicit high-net-worth clients
• 18 customers complained about "unauthorized contact" from the ex-employee
• RBI cyber security audit flagged "inadequate access revocation" as a major finding
• The incident was a personal data breach: BFS had to report to CERT-In within 6 hours and inform affected customers, and RBI's inspection raised it with the bank
• The ex-employee was not bound by a non-solicitation agreement (no such clause in contract)
• The bank had 2,000+ exits per year (high turnover in frontline staff) with no formal exit security procedure
• Exit interviews were just "how was your experience?" with no security focus
• Exit security steps were not completed by the last working day
• Role changes were common (promotion to branch manager, transfer to new branch) but old access was never removed
• The bank had 47,000+ active accounts for 6,500 employees (massive over-provisioning)
• Shadow IT was rampant: employees used personal WhatsApp, Google Drive, and personal email for work

Solution:

1. Months 1-2: Crisis Assessment and Rapid Fix

   • Engaged an external security consultant for emergency exit security redesign
   • Conducted complete access audit: 47,000 accounts for 6,500 employees
   • Identified 12,000 orphaned accounts (ex-employees, role changes, contractors)
   • Revoked all 12,000 orphaned accounts immediately (emergency fix)
   • Identified 800 employees with excess access (not needed for their role)
   • Created emergency access revocation procedure for all exits (48-hour SLA)
   • Created RBI compliance remediation plan

2. Months 3-4: Enterprise Exit Framework

   • Designed enterprise exit security framework for 6,500 employees
   • Created role-based access control (RBAC) for 200+ roles in banking
   • Created complete access inventory (all 47+ systems, all 6,500 employees)
   • Implemented automated access revocation through core banking system integration
   • Created exit security checklist (70+ items for banking context)
   • Created garden leave policy for relationship managers and senior roles (RBI requirement)
   • Implemented 30-day garden leave for all customer-facing roles

3. Months 5-6: DLP and Monitoring

   • Implemented Symantec DLP across all endpoints and email
   • Configured DLP for customer data, KYC, financial data, RBI reports
   • Implemented 30-day pre-exit monitoring for all resignations (high-risk in banking)
   • Set up email forwarding rule monitoring
   • Implemented UEBA for behavioral anomaly detection
   • Created post-employment monitoring framework (customer contact detection, competitive intelligence)
   • Created RBI reporting dashboard for exit security metrics

4. Months 7-8: Union and Contract Alignment

   • Engaged union for exit security alignment (CBA renewal was upcoming)
   • Union initially resisted "surveillance" but agreed after security risk education
   • Negotiated: exit security training is paid, security equipment provided, no personal surveillance, due process for all exits
   • CBA updated with security exit terms: asset return, access revocation, data obligations, garden leave
   • Updated employment contracts for all new hires with complete NDA, IP, non-solicitation
   • Obtained NDA addendum from 6,000 existing employees (98% compliance)
   • Created legal enforcement framework for banking context (RBI reporting, customer notification)

5. Months 9-12: Implementation and RBI Compliance

   • Implemented HRIS-IT integration (Workday → core banking → IT ticket)
   • Trained 600 branch managers on exit security procedures (2-hour session)
   • Trained 50 HR staff on exit security coordination
   • Created exit interview with security focus for banking (20 questions)
   • Implemented security clearance certificate for all exits
   • Built exit security checks into the notice period, completed before the last working day
   • Created role change access adjustment procedure (remove old branch access, add new branch access)
   • Processed 2,000 exits with new procedure in first year
   • RBI audit: zero findings on exit security; commendation for improvement

Results:

• Orphaned accounts: Zero (from 12,000)
• Access revocation: 100% within 48 hours (from 7+ days)
• Excess access: Reduced from 800 employees to 50 employees (ongoing cleanup)
• Garden leave: 100% compliance for customer-facing roles (RBI requirement)
• DLP alerts: 45 data exfiltration attempts detected and prevented in first year
• Post-employment breaches: Zero detected (vs. 1 major before)
• RBI audit: Zero findings on exit security; penalty avoided
• Customer complaints: Zero unauthorized contact complaints (from 18 before)
• Role change access: 98% adjusted within 24 hours (from no adjustment before)
• Union relations: First bank with union-approved exit security terms
• Cost: program investment vs. RBI penalty + reputational damage + customer loss
• Industry recognition: Featured in RBI cybersecurity best practices for exit management

Multi-Framework Mapping

The references below genuinely overlap with A.6.5. Use them when one set of evidence must satisfy several frameworks.

Regulatory and Industry Context

India Regulatory Framework

International Regulations

Sector-Specific Requirements

Roles and Responsibilities (RACI)

Documentation and Evidence Requirements

Required Documents

Continuous Improvement

Figure · Tiers

Maturity levels for responsibilities after termination or change of employment

Maturity Model (Level 1-5)

Improvement Cycle

• Plan: Annual review of exit policy; quarterly metrics; industry benchmarking; regulatory updates; employee feedback; legal trend analysis
• Do: Deploy new tools; update access matrices; train managers; enhance monitoring; improve automation; update contracts; refine DLP
• Check: Measure access revocation speed; audit asset return; verify DPDP compliance; benchmark; gather feedback; review legal cases; analyze breaches
• Act: Standardize; communicate; update procedures; report to management; share best practices; union collaboration; legal framework refinement

Technology Trends

• AI Exit Risk Scoring: AI predicting which departing employees pose highest data theft risk
• Automated Forensics: Automated forensic imaging and analysis of departing employee devices
• Blockchain Asset Provenance: Blockchain tracking of asset ownership and return
• Predictive Analytics: Predicting employee departure before resignation (behavioral indicators)
• Digital Exit Assistant: AI-powered chatbot guiding employees through exit process
• Continuous Access Verification: Real-time verification that all access is revoked across all systems
• Post-Employment Digital Footprint Monitoring: AI monitoring ex-employee digital footprint for IP violations
• Smart Contracts for Enforcement: Blockchain-based smart contracts for post-employment obligations
• Integrated Lifecycle Management: Single platform managing employee from onboarding to exit
• Zero-Trust Exit: Zero-trust architecture ensuring no lingering trust relationships post-exit

FAQ

Frequently Asked Questions (20 Questions)

Q1: Is a formal exit security procedure required for ISO 27001 certification? A: Not automatically. No Annex A control is mandatory. Under clause 6.1.3 you choose the controls your risk assessment calls for, then record A.6.5 in your Statement of Applicability as included (and how) or excluded (and why). Almost every organisation with leavers or role changes includes it. If you include it, auditors will look at how post-exit obligations are defined and communicated, and will usually sample leavers to check access removal and asset return (which also touch A.5.11 and A.5.18).

Q2: What is the timeline for access revocation after termination? A: For involuntary termination or suspension, access should be revoked within 1-4 hours. For voluntary resignation, access should be revoked on the last working day. Critical systems (admin, customer data, financial) should be revoked immediately upon notice of resignation for customer-facing roles.

Q3: Can we withhold full and final settlement if an employee doesn't return assets? A: Not the wages. Wages due on exit must be paid within two working days (Code on Wages 2019, s.17(2)). You may deduct for an unreturned asset only if it was expressly entrusted to the employee and the loss is due to their neglect or default, within the s.18 limits. Gratuity can be forfeited only on the narrow s.53(6) grounds of the Code on Social Security 2020, and PF cannot be withheld. Otherwise, recover the asset or its value through a demand notice or civil claim. Consult Legal first.

Q4: Are non-compete clauses enforceable in India? A: Generally, post-employment non-compete clauses are void under Section 27 of the Indian Contract Act (restraint of trade). However, non-compete may be enforceable during employment and for sale of goodwill. Focus on enforceable tools: NDA, non-solicitation, IP assignment, and garden leave.

Q5: What is garden leave and when should it be used? A: Garden leave is a period where the employee is paid but does not work. All access is revoked. It's commonly used in BFSI (RBI requirement) and for senior technical/customer-facing roles. It reduces data exfiltration risk during the notice period.

Q6: Do we need to monitor ex-employees after they leave? A: Yes, but within legal and privacy limits. You can monitor for violations of contractual obligations (NDA, non-solicitation, IP). You cannot conduct surveillance of personal life. DPDP compliance is required. Monitoring should be documented and justified.

Q7: What should we do if an ex-employee takes confidential data to a competitor? A: (1) Gather evidence of breach, (2) Send breach notice (cease and desist), (3) Attempt settlement, (4) Seek court injunction if urgent, (5) File civil suit for breach of contract and trade secret misappropriation, (6) If criminal, file police complaint, (7) Notify regulator if required (RBI, SEBI, etc.).

Q8: How do we handle remote worker exits? A: Remote worker exits require: (1) prepaid shipping labels for device return, (2) video call exit interview, (3) remote access revocation (same timeline), (4) remote data deletion guidance, (5) BYOD device verification (if MDM), (6) home office equipment return, (7) courier tracking for asset return.

Q9: What is the difference between exit for voluntary resignation and involuntary termination? A: Voluntary resignation: notice period, gradual access restriction, knowledge transfer, exit interview, standard timeline. Involuntary termination: immediate access revocation, no exit interview (if for cause), forensic image, rapid asset collection, potential legal action.

Q10: Do we need an exit interview for every departing employee? A: Yes. The exit interview should include security-focused questions (obligations reminder, asset verification, data deletion). Even for involuntary termination, a security reminder can be communicated (though not a traditional "interview"). Document the security communication.

Q11: How do we handle role changes (promotion, transfer)? A: Role changes require: (1) access revocation for old role, (2) access provisioning for new role, (3) asset return/reassignment, (4) new role security training, (5) knowledge transfer, (6) verification that old access is removed. Use RBAC to automate.

Q12: What is a data deletion affidavit and is it required? A: A data deletion affidavit is a signed statement by the departing employee confirming that all company data has been deleted from personal devices and accounts. It is not legally required but is strong evidence in case of future breach. Highly recommended for all exits.

Q13: How do we handle BYOD devices at exit? A: If the device is enrolled in MDM, the company data container can be remotely wiped. If not enrolled, the employee must sign a data deletion affidavit. For high-risk exits, you may request a device scan (with consent). Include BYOD obligations in the employment contract.

Q14: What is the DPDP requirement for ex-employee data? A: Ex-employee personal data must be retained only for legal and compliance purposes (tax, labor law, legal claims). You must delete data when the legal retention period expires. You must justify retention. Ex-employees have DPDP rights (access, correction, grievance) unless exempted.

Q15: Can we change shared passwords when an employee leaves? A: Yes, and you should. If the departing employee knew shared account passwords (e.g., admin accounts, service accounts), those passwords must be changed immediately. Include this in the access revocation checklist.

Q16: What happens if an employee dies? A: Exit procedure for death: (1) Immediate access revocation (no family authorisation is needed), (2) Asset collection from family (with sensitivity), (3) Data recovery and transfer, (4) Personal data separation and return to family, (5) Settlement processing per labor law, (6) Legal compliance for estate. Under the DPDP Act, a person's nominee (s.14) can exercise their data rights after death.

Q17: How do we handle contractor exits? A: Contractor exits should follow the same procedure as employees: (1) Access revocation, (2) Asset return, (3) Data deletion, (4) Contractual obligation reminder, (5) Notify contractor's employer (if applicable), (6) Settlement per contract terms. No gratuity or PF for contractors.

Q18: What is the role of CISO in exit security? A: CISO is accountable for: access revocation, security assessment, device forensics, data deletion verification, post-employment monitoring, incident investigation, DLP monitoring, and security clearance. CISO does not manage HR or settlement but ensures security aspects are complete.

Q19: Can we recover costs for unreturned assets? A: Yes, but within legal limits. You can deduct the cost of unreturned assets from the final salary (with legal compliance). You cannot deduct from gratuity or PF. The deduction must be documented and justified. Consult Legal.

Q20: What will an ISO 27001 auditor look for in A.6.5? A: The auditor will verify: (1) formal exit procedure exists, (2) procedure covers all exit types, (3) access is revoked within defined timelines, (4) assets are returned and verified, (5) data deletion is verified, (6) exit interview includes security focus, (7) post-employment obligations are in contracts, (8) obligations are communicated at exit, (9) full and final settlement is linked to security clearance, (10) role change procedure exists, (11) there is evidence of use (records, checklists, certificates), and (12) DPDP compliance is maintained.

References and Further Reading

ISO Standards

• ISO 27001:2022: Information Security Management Systems
• ISO 27002:2022: Information Security Controls
• ISO/IEC 27701:2025: Privacy information management systems

Indian Law

• Indian Contract Act 1872: Section 27 (restraint of trade)
• Industrial Relations Code 2020 (from 21 Nov 2025 replaced the Industrial Disputes Act 1947 and the Industrial Employment (Standing Orders) Act 1946)
• Code on Social Security 2020 (replaced the Payment of Gratuity Act 1972)
• Code on Social Security 2020 (replaced the EPF Act 1952)
• Code on Wages 2019: Sections 17(2) and 18 (wages due within two working days of exit; permitted deductions)
• Code on Wages 2019 (replaced the Minimum Wages Act 1948)
• Companies Act 2013
• DPDP Act 2023
• IT Act 2000
• Copyright Act 1957
• Patents Act 1970
• Trade Secrets (common law)
• Official Secrets Act 1923
• POSH Act 2013

International

• GDPR (EU): Articles 5, 17, 32
• HIPAA (US): §164.308(a)(3)(ii)(C), Termination procedures
• SOX (US): Internal controls
• UK Employment Rights Act 1996
• EU Whistleblower Directive
• ILO Convention: Worker rights
• FCRA (US): Adverse action
• CCPA (California): Employee data privacy

Industry

• RBI Cyber Security Framework: Exit procedures for banking
• SEBI CSCRF (2024): Access revocation
• IRDAI Guidelines: Exit procedures for insurance
• NASSCOM: IT industry employment practices
• ISACA: Security and governance guidance
• Data Security Council of India: Data protection best practices
• Verizon DBIR: Data breach investigations
• Symantec: Insider threat reports
• Kaspersky: Employee data theft statistics