Access removal is easy to miss when identities are spread across cloud platforms, SaaS tools, source-control systems, remote-access services, shared secrets, and local applications. Offboarding should close the full access path rather than only disabling one directory account.
Use an access inventory
Identify primary identities, privileged roles, application accounts, API tokens, VPN access, source-control access, shared credentials, physical or device access where relevant, and external supplier identities tied to the departing relationship.
Match timing to the situation
Planned role changes may allow an orderly transfer of ownership, while urgent separation or suspected compromise may require immediate revocation. Make the trigger and responsible roles clear before an event occurs.
Transfer ownership before deleting critical identities
Reassign repositories, service accounts, scheduled jobs, encryption or recovery responsibilities, vendor portals, and business records so access removal does not create an operational outage.
Verify closure
Check that active sessions, tokens, keys, delegated permissions, and privileged roles are no longer usable where those mechanisms apply. Record completion and unresolved exceptions.
Coordinate employment and legal decisions
Security teams should implement authorized access changes, not determine employment, legal, contractual, or records-retention requirements on their own.
Related knowledge
Continue with Privileged Access Reviews, Cybersecurity Third-Party Access, Cybersecurity Asset Ownership, and Security Logging Coverage.
References
This is general cybersecurity guidance. Employment, legal, contractual, privacy, regulatory, and records-retention requirements need qualified review.