Navigate

PS-4

PS-4: Personnel Termination

The organization, upon termination of individual employment:

PS-4a.: Disables information system access within [Assignment: organization-defined time period];

PS-4b.: Terminates/revokes any authenticators/credentials associated with the individual;

PS-4c.: Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics];

PS-4d.: Retrieves all security-related organizational information system-related property;

PS-4e.: Retains access to organizational information and information systems formerly controlled by terminated individual; and

PS-4f.: Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].

Supplemental

Information system-related property includes, for example, hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that proper accountability is achieved for information system-related property. Security topics of interest at exit interviews can include, for example, reminding terminated individuals of nondisclosure agreements and potential limitations on future employment. Exit interviews may not be possible for some terminated individuals, for example, in cases related to job abandonment, illnesses, and nonavailability of supervisors. Exit interviews are important for individuals with security clearances. Timely execution of termination actions is essential for individuals terminated for cause. In certain situations, organizations consider disabling the information system accounts of individuals that are being terminated prior to the individuals being notified.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Classified, Int-A, Int-B, Int-C, Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to PS-4.

Control	Description
AC-2	The organization: AC-2a.: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types]; AC-2b.: Assigns account managers for information system accounts; AC-2c.: Establishes conditions for group and role membership; AC-2d.: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; AC-2e.: Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts; AC-2f.: Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions]; AC-2g.: Monitors the use of information system accounts; AC-2h.: Notifies account managers: AC-2h.1.: When accounts are no longer required; AC-2h.2.: When users are terminated or transferred; and AC-2h.3.: When individual information system usage or need-to-know changes; AC-2i.: Authorizes access to the information system based on: AC-2i.1.: A valid access authorization; AC-2i.2.: Intended system usage; and AC-2i.3.: Other attributes as required by the organization or associated missions/business functions; AC-2j.: Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency]; and AC-2k.: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
IA-4	The organization manages information system identifiers by: IA-4a.: Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, or device identifier; IA-4b.: Selecting an identifier that identifies an individual, group, role, or device; IA-4c.: Assigning the identifier to the intended individual, group, role, or device; IA-4d.: Preventing reuse of identifiers for [Assignment: organization-defined time period]; and IA-4e.: Disabling the identifier after [Assignment: organization-defined time period of inactivity].
PE-2	The organization: PE-2a.: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; PE-2b.: Issues authorization credentials for facility access; PE-2c.: Reviews the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency]; and PE-2d.: Removes individuals from the facility access list when access is no longer required.
PS-5	The organization: PS-5a.: Reviews and confirms ongoing operational need for current logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization; PS-5b.: Initiates [Assignment: organization-defined transfer or reassignment actions] within [Assignment: organization-defined time period following the formal transfer action]; PS-5c.: Modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and PS-5d.: Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].
PS-6	The organization: PS-6a.: Develops and documents access agreements for organizational information systems; PS-6b.: Reviews and updates the access agreements [Assignment: organization-defined frequency]; and PS-6c.: Ensures that individuals requiring access to organizational information and information systems: PS-6c.1.: Sign appropriate access agreements prior to being granted access; and PS-6c.2.: Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [Assignment: organization-defined frequency].

Enhancements

The controls below (if any) add on to the requirements of PS-4.

Control	Description
PS-4 (1)	The organization: PS-4 (1)(a): Notifies terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information; and PS-4 (1)(b): Requires terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.
PS-4 (2)	The organization employs automated mechanisms to notify [Assignment: organization-defined personnel or roles] upon termination of an individual.

Related CCIs

The CCIs below are tied to PS-4.

CCI	Definition
CCI-001522	The organization, upon termination of individual employment, disables information system access within an organization-defined time period.
CCI-001523	The organization, upon termination of individual employment, conducts exit interviews that include a discussion of organization-defined information security topics.
CCI-001524	The organization, upon termination of individual employment, retrieves all security-related organizational information system-related property.
CCI-001525	The organization, upon termination of individual employment, retains access to organizational information formerly controlled by the terminated individual.
CCI-001526	The organization, upon termination of individual employment, retains access to organizational information systems formerly controlled by the terminated individual.
CCI-003016	The organization, upon termination of individual employment, notifies organization-defined personnel or roles within an organization-defined time period.
CCI-003022	The organization defines the time period within which to disable information system access upon termination of individual employment.
CCI-003023	The organization, upon termination of individual employment, terminates/revokes any authenticators/credentials associated with the individual.
CCI-003024	The organization defines information security topics to be discussed while conducting exit interviews.
CCI-003025	The organization defines personnel or roles to notify upon termination of individual employment.
CCI-003026	The organization defines the time period within which to notify organization-defined personnel or roles upon termination of individual employment.