CCI-001523

Upon termination of individual employment, conduct exit interviews that include a discussion of organization-defined information security topics.

Implementation Guidance

Determine if upon termination of individual employment, exit interviews that include a discussion of [PS-04_ODP[02]; information security topics to be discussed when conducting exit interviews are defined] are conducted.

Validation Procedures

Examine: [SELECT FROM: Personnel security policy; procedures addressing personnel termination; records of personnel termination actions; list of system accounts; records of terminated or revoked authenticators/credentials; records of exit interviews; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personnel security responsibilities; organizational personnel with account management responsibilities; system/network administrators; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for personnel termination; mechanisms supporting and/or implementing personnel termination notifications; mechanisms for disabling system access/revoking authenticators].

The controls below (if any) were marked by NIST as being related to CCI-001523.