ISO 27001 Annex A 6.5 Responsibilities after employment termination or role change
What it says
Information security responsibilities and duties that remain valid after termination or change of employment shall be defined, enforced and communicated to relevant personnel and other interested parties.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure security responsibilities are clear when employment ends or roles change.
When someone leaves your organisation or changes roles, their responsibilities related to keeping information safe need to be clear. Think of it like making sure someone locks the door behind them after they leave. If we don't do this, sensitive information could get into the wrong hands, leading to data breaches or misuse.
Free. Save your status, tasks and notes.
Why it matters
If post-employment/role-change duties aren't defined and enforced, staff may misuse retained access or disclose information, causing breaches and legal/reputational harm.
How to implement
The HR department should clearly outline ongoing security responsibilities in employment contracts.
They can do this by including specific clauses about confidentiality and information security duties that continue even after an employee leaves or changes positions.
Managers must ensure that when someone changes roles, their old security responsibilities are managed and handed over properly.
They should create a checklist for outgoing tasks and responsibilities, ensuring nothing falls through the cracks.
IT administrators must promptly disable access to systems for employees leaving the company or changing roles.
They need to have a standard procedure that includes revoking access to emails and databases to prevent unauthorised access.
The legal team should review and update confidentiality agreements periodically to ensure they cover all aspects of information security relevant to former employees.
They should cross-check these agreements with the latest regulations, such as the Privacy Act 1988.
The security team should conduct exit interviews that include a section on information security.
During these interviews, they should remind exiting employees of their ongoing confidentiality obligations, as described in their contracts.
Keep it running
At termination/role change, promptly revoke/adjust access, recover assets, update role responsibilities, and remind personnel of ongoing confidentiality and security obligations.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request documentation outlining employee offboarding procedures.
Look at
Check for defined processes for disabling systems access and reassigning responsibilities.
Good evidence
Clear, documented procedures that include comprehensive steps for managing information security responsibilities during employment changes.
- Check 2 of 5What an auditor asks for
Ask for
Ask for examples of employment contracts or non-disclosure agreements.
Look at
Verify presence of clauses related to confidentiality and ongoing security responsibilities.
Good evidence
Contracts include specific language on post-employment security duties, aligning with organisational policies.
- Check 3 of 5What an auditor asks for
Ask for
Require a log of access revocations and systems changes for former employees.
Look at
Ensure access rights are promptly disabled and documented upon employment termination or role change.
Good evidence
Access logs show timely deactivation of accounts and access removal, with no unnecessary delays.
- Check 4 of 5What an auditor asks for
Ask for
Request records from recent exit interviews that address security responsibilities.
Look at
Look for notes indicating that ongoing information security duties were discussed.
Good evidence
Exit interviews consistently document a discussion on continued confidentiality obligations.
- Check 5 of 5What an auditor asks for
Ask for
Inquire about training materials or sessions on information security for departing employees.
Look at
Check that training includes a section on responsibilities after leaving the organisation.
Good evidence
Training content highlights the importance of ongoing confidentiality and security principles.
Mappings
Closest match in ASD Information Security Manual: ISM-0430, Same-day removal or suspension of access no longer required, which partially overlaps with this control.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-0430.
Annex A 6.5 requires information security responsibilities and duties that continue after termination or a role change to be defined, enforced and communicated. ISM-0430 relates by mandating same-day removal or suspension of system access when personnel no longer have a legitimate requirement, which is a key offboarding/mover enforcement activity aligned to post-change security obligations. However, Annex A 6.5 is broader in covering ongoing obligations (e.g. confidentiality, return of assets, continued handling requirements) and communication to interested parties, not just access removal timing.
This control partially overlaps ISM-1569.
Annex A 6.5 requires ongoing information security obligations to be defined, enforced and communicated when employment terminates or roles change. ISM-1569 overlaps because a documented shared responsibility model commonly includes continuing obligations after an engagement changes (e.g., confidentiality, return/handling of customer data, and notification responsibilities), which are analogous to post-termination duties. However, ISM-1569 is focused on supplier-customer accountability rather than internal employee offboarding, so it does not fully cover Annex A 6.5's personnel termination/role-change requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.