A.6.5 Responsibilities after termination or change of employment

Control objective

This control ensures that information security responsibilities and obligations that must remain valid after the employment relationship ends (resignation, contract expiry, dismissal) or a role changes (transfer, promotion, reassignment) are defined, clearly communicated to the affected person, and enforced. Even when a person's status or affiliation changes, the duty of non-disclosure over confidential information acquired during employment, the protection of intellectual property, and any outstanding handover obligations must persist for a defined period. If these surviving responsibilities are unclear, the moment of personnel change becomes a weak point for information leakage or misuse. The control aims to prevent control gaps caused by personnel changes by embedding the content, validity period, and notification method of surviving responsibilities into the termination/change process.

Key checkpoints

Are information security responsibilities that persist after termination or role change (confidentiality, non-disclosure, asset return, handover of unfinished work) specified in contracts/security pledges/policies?
Are the duration and scope of surviving obligations communicated in writing, with acknowledgement or evidence of delivery and reasons an acknowledgement could not be obtained?
On a role change, are access rights and responsibilities granted for the previous role revoked or readjusted and reset against the new role?
Does the termination/role-change procedure define the roles of HR, information security, and line managers, together with the notification flow and handover steps?
Is there a basis for response/sanctions and legal action in the event of a breach of the surviving obligations?

Implementation guidance

Include confidentiality/non-disclosure/information-protection clauses that remain valid after termination in employment contracts and security pledges, and state the validity period for each clause.
Operate a termination/role-change checklist so that asset return, access revocation, account deactivation, and knowledge/work handover are all completed without omission.
Define the notification flow for personnel changes among HR, information security, and line managers so that termination/change information is shared promptly and drives follow-up actions.
On a role change, re-grant only the access needed for the new role under the least-privilege principle and immediately remove previous privileges that are no longer needed.
Re-communicate surviving obligations in writing at termination/role change and seek acknowledgement where possible. If refusal or absence prevents a signature, record delivery and the reason, without delaying account or privilege revocation.
Reflect the response procedure, reporting channels, and legal basis for breaches of surviving obligations in policy, and ensure relevant departments are aware of them.

Related controls and attributes

Evidence

Employment contract/security pledge templates containing post-termination clauses (confidentiality/non-disclosure)
Termination/role-change procedure documents and checklists
Asset return confirmations, access revocation/account deactivation records
Exit briefing/surviving-obligation re-notification confirmations (signed by the individual, or a delivery record with the reason a signature could not be obtained)
Personnel-change notification records between HR and information security, and work handover documents

Nonconformity examples

A leaver is not informed of surviving confidentiality obligations and no record demonstrates that notice was delivered.
After a role change, access rights granted for the previous department/role are not revoked and remain in place.
Contracts/security pledges do not include information security responsibility clauses that remain valid after termination.
On termination, asset return and account deactivation are delayed, so employment-level privileges persist for a period.
There are no response/sanction criteria to apply when surviving obligations are breached, so breaches cannot be acted upon.