Key takeaways
- Security duties that continue after someone leaves must be defined and communicated.
- Responsibilities like confidentiality do not end when someone leaves.
- Start here: use an offboarding checklist covering access removal and asset return.
Purpose
Security duties that continue after someone leaves must be defined and communicated.
Requirement
Requirement summaryInformation security responsibilities and duties that remain valid after termination or change of employment shall be defined, enforced and communicated to relevant personnel and other interested parties.
Why it matters
Responsibilities like confidentiality do not end when someone leaves. Exit processes protect information after departure.
How to implement
- Use an offboarding checklist covering access removal and asset return.
- Remind leavers of ongoing confidentiality obligations.
- Handle role changes as a mini-offboarding for old access.
- Record completion of each step.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 6.5. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your leaver process, including reminding people of duties that continue after they leave (such as confidentiality).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.6.5 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Exit letters or checklists showing leavers were reminded of ongoing duties.
- Records showing responsibilities and access were updated when people changed role.
Things you should be able to show or explain
- HR should be able to explain how this reminder is given.
How much to show: A handful of leavers and people who changed roles.
Common mistakes
- No reminder at exit.
- Role changes not reflected in access.
- Access still active weeks after someone left.
- No reminder of post-employment duties.
- Tip: Remind leavers of confidentiality duties in the exit interview.
Policies & documents to have
- Human Resource Security Policy
- Employee Termination Security Policy
FAQ
Is A.6.5 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.6.5?
Be ready to explain how the control works in your organisation and to provide things like: Your leaver process, including reminding people of duties that continue after they leave (such as confidentiality)…