Navigate

CCI-003023

CCI-003023 Definition

The organization, upon termination of individual employment, terminates/revokes any authenticators/credentials associated with the individual.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed documents and implements a process to terminate/revoke any authenticators/credentials associated with the individual upon termination of individual employment. The organization must maintain records of termination/revocation of any authenticators/credentials.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as a sampling of records of termination/revocation of any authenticators/credentials to ensure the organization being inspected/assessed terminates/revokes any authenticators/credentials associated with the individual upon termination of individual employment.

Compelling Evidence

1.) SOP/TTP documentation on procedure for revocation of any authenticators/credentials associated with terminated individuals. 2.) Records of actual termination/revocation of any authenticators/credentials upon termination of individuals.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003023.

Control	Description
PS-4	The organization, upon termination of individual employment: PS-4a.: Disables information system access within [Assignment: organization-defined time period]; PS-4b.: Terminates/revokes any authenticators/credentials associated with the individual; PS-4c.: Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics]; PS-4d.: Retrieves all security-related organizational information system-related property; PS-4e.: Retains access to organizational information and information systems formerly controlled by terminated individual; and PS-4f.: Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].

Control

Description

PS-4

The organization, upon termination of individual employment:

PS-4a.: Disables information system access within [Assignment: organization-defined time period];

PS-4b.: Terminates/revokes any authenticators/credentials associated with the individual;

PS-4c.: Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics];

PS-4d.: Retrieves all security-related organizational information system-related property;

PS-4e.: Retains access to organizational information and information systems formerly controlled by terminated individual; and

PS-4f.: Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].