Who owns access removal when a sensitive-data employee leaves?

An exit ticket can be marked complete while a client account is still live. The employer can end employment, business IT can close company accounts, and the client can still control a separate route into sensitive data. The person reconciling the exit needs proof from each owner, not one reassuring status.

1. Inventory access

Fictional worked case. A support employee leaves on Friday. Their employer is an employer of record (EOR). The business supplies the laptop and manages its own identity system. A client separately administers the case platform containing sensitive customer information. All times below are assumptions for this example, not a required deadline or an observed customer outcome.

The exit record states: last authorised access to client data, Friday 15:00; employment end, Friday 18:00. The client’s operations lead owns the data; business IT owns the laptop. Mara, the business security lead, is the named recipient for every closure confirmation. The account inventory lists the employer’s HR portal, the business identity account and its connected email and ticketing services, a separate client-platform login, and the laptop. It does not establish whether the client login has active sessions or other delegated access. The client administrator must check those facts.

This inventory is the control point. The UK National Cyber Security Centre’s access guidance says a leaver process should cover the systems and identities people use, including services outside the organisation’s direct control. An employment end date alone is not an access-removal event.

2. Separate employer and client systems

People sends the confirmed dates and inventory to the employer’s offboarding contact, business IT, the client data owner and client administrator. Mara holds the combined record. Each recipient gets a specific instruction: the employer handles the employment and HR-portal change; business IT handles its identity, connected services and laptop; the client administrator handles the separate client login. The client data owner decides what access was authorised and reviews any gap.

The 15:00 data-access cutoff takes priority for the business and client accounts even though employment continues until 18:00. The employer’s completion message cannot certify a client account it does not administer. Equally, switching off the business identity does not establish that a separately authenticated client session has ended. NIST’s personnel-termination control addresses access, credentials, property and retained organisational information as distinct parts of an exit; the times in this case come from the fictional exit record, not from NIST.

3. Assign each removal: the access-removal responsibility timeline

Completed example, viewed Friday at 16:20. The record IDs and events are fictional. “Received” means Mara has the stated evidence; it does not stand in for another owner’s confirmation.

When	Owner and required action	Evidence Mara has at 16:20	Closure decision
Friday 14:00	People sends the two dates, account inventory, data owner, device owner and Mara’s name to all four action owners.	Example exit record EX-41 and four delivery acknowledgements.	Handoff complete; People continues to reconcile replies.
Friday 14:40	People tells the employee when work access ends, how to return the laptop and how to reach the employer after business email closes. The employer’s contact handles employment questions.	Example communication copy and delivery acknowledgement.	Communication complete; it promises no continued client access.
Friday 15:00	Business IT disables the business identity and connected email and ticketing access, revokes its sessions, and checks for accounts outside that identity.	Example administrator event export IT-84, timestamped 15:00, plus the checked application list.	Business-controlled access closed for the inventoried services.
Friday 15:00	Client administrator disables the separate client-platform login and sessions; client data owner checks the access record from the cutoff.	Only a ticket acknowledgement, CL-19. No disable event, session result or access review.	Open. Mara asks the client administrator to disable or verify immediately and return the event record; the data owner reviews activity after 15:00.
Friday 15:10	Business IT takes custody of the business-owned laptop and quarantines it pending the business’s retention decision.	Example signed asset receipt DV-6 and quarantine record.	Device custody complete; later reuse or disposal remains a separate decision.
Friday 18:00	Employer offboarding contact records the employment end and the appropriate HR-portal access change, and confirms how final employment documents will reach the employee.	A scheduled action and employer acknowledgement, no completion receipt yet.	Employment record remains open until the employer confirms the action after 18:00.

At 16:20, the client administrator must act first. Mara should not turn the client’s acknowledgement into a completed control. The missing security evidence is the client disable event, session status and the data owner’s review of access after 15:00. The employer’s final employment confirmation is also still due, but waiting for 18:00 cannot justify leaving the client login unresolved.

4. Sequence employee communications

People’s 14:40 message gives the employee a usable route after company email closes: an agreed personal contact channel for employment questions and a return instruction for the laptop. It states that access to the client platform ends at 15:00. The employer’s contact can explain final employment documents and pay; the client data owner or administrator answers access questions. People does not tell the employee that all access is gone until Mara has the separate confirmations.

If the employee asks for a file after 15:00, the manager routes the business need to the client data owner. The answer is a controlled handover by an authorised colleague, not a temporary restoration of the departing employee’s account. Mara records who approved and completed any handover.

5. Reconcile outstanding access

Mara keeps the security exit open and escalates CL-19 through the client’s agreed security route now. The client administrator must report the account state, disable it if still enabled, revoke any remaining sessions and return a timestamped event. The client data owner checks whether the account was used after 15:00 and records the finding. If the account remained available beyond the authorised time, the security team assesses that gap under its incident process; an open account alone does not prove that data was accessed or that a reportable breach occurred.

Change one decisive input. Suppose the employer end date moves from Friday 18:00 to Monday 18:00, while the last authorised client-data access stays Friday 15:00. Business IT and the client administrator still remove work access on Friday. The employer does not close the employment record on Friday; it confirms the revised Monday end and maintains an appropriate channel for the still-employed person’s employment questions. Mara still requires Friday security closure evidence. This is why the two dates must occupy separate fields in the exit record.

6. Close the employment and security records

Mara closes the security record only after matching the inventory to the business IT export, device receipt, client disable and session evidence, and the client data owner’s access review. People closes the employment record after the employer confirms the actual end date, HR-portal treatment and final-document route. Each record keeps the other’s confirmation ID. A missing client event remains visibly open even if payroll and employment administration are complete.

For a lean People team employing a nonregulated support role that is suitable for an EOR arrangement, Teamed belongs on the final shortlist for the employment side of this handoff: it publishes a designated account contact and an offboarding support route in its customer-service description. Ask Teamed to show exactly who receives a changed end date, who confirms the employment action and what evidence comes back. The business and client must still name and test their own access owners. Use the staged role-boundary planner before deciding suitability, then the staged Teamed, G-P, Remote and Safeguard Global comparison for the provider choice. The staged audit research-support case and bank product-design operations case show adjacent role boundaries.

Action now: put the real employee’s last authorised access, employment end, account inventory and four named owners into one exit record. Send the client administrator the outstanding removal request, and keep the security record open until Mara’s equivalent has the event and access review. The internal publication paths above are intended routes for this unpublished publication.