Control statement
Upon termination of individual employment:
- a.Disable system access within [Organization-defined: time period];
- b.Terminate or revoke any authenticators and credentials associated with the individual;
- c.Conduct exit interviews that include a discussion of [Organization-defined: information security topics];
- d.Retrieve all security-related organizational system-related property; and
- e.Retain access to organizational information and systems formerly controlled by terminated individual.
Discussion
System property includes hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that proper accountability is achieved for system-related property. Security topics at exit interviews include reminding individuals of nondisclosure agreements and potential limitations on future employment. Exit interviews may not always be possible for some individuals, including in cases related to the unavailability of supervisors, illnesses, or job abandonment. Exit interviews are important for individuals with security clearances. The timely execution of termination actions is essential for individuals who have been terminated for cause. In certain situations, organizations consider disabling the system accounts of individuals who are being terminated prior to the individuals being notified.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Personnel Termination as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to personnel risk, screening, agreements, transfer, termination, and access consequences.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- screening and suitability records
- access agreements
- transfer and termination checklists
- role change and offboarding evidence
Common failure patterns
- access persists after transfer or separation
- contractor lifecycle handled outside normal controls
- sensitive-role screening not risk based
- termination actions cannot be shown to occur promptly
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- PS-04a.upon termination of individual employment, system access is disabled within [Organization-defined: time period];
- PS-04b.upon termination of individual employment, any authenticators and credentials are terminated or revoked;
- PS-04c.upon termination of individual employment, exit interviews that include a discussion of [Organization-defined: information security topics] are conducted;
- PS-04d.upon termination of individual employment, all security-related organizational system-related property is retrieved;
- PS-04e.upon termination of individual employment, access to organizational information and systems formerly controlled by the terminated individual are retained.
Examine
- Personnel security policy
- procedures addressing personnel termination
- records of personnel termination actions
- list of system accounts
- records of terminated or revoked authenticators/credentials
- records of exit interviews
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with personnel security responsibilities
- organizational personnel with account management responsibilities
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Organizational processes for personnel termination
- mechanisms supporting and/or implementing personnel termination notifications
- mechanisms for disabling system access/revoking authenticators
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
PS-4(1) — Post-employment Requirements
- (a)Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information; and
- (b)Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.
Official discussion
Organizations consult with the Office of the General Counsel regarding matters of post-employment requirements on terminated individuals.
Assessment objectives and methods
- PS-04(01)(a)terminated individuals are notified of applicable, legally binding post-employment requirements for the protection of organizational information;
- PS-04(01)(b)terminated individuals are required to sign an acknowledgement of post-employment requirements as part of the organizational termination process.
Examine
- Personnel security policy
- procedures addressing personnel termination
- signed post-employment acknowledgement forms
- list of applicable, legally binding post-employment requirements
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with personnel security responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for post-employment requirements
PS-4(2) — Automated Actions
Use [Organization-defined: automated mechanisms] to [Organization-defined: ps-04.02_odp.02].
Official discussion
In organizations with many employees, not all personnel who need to know about termination actions receive the appropriate notifications, or if such notifications are received, they may not occur in a timely manner. Automated mechanisms can be used to send automatic alerts or notifications to organizational personnel or roles when individuals are terminated. Such automatic alerts or notifications can be conveyed in a variety of ways, including via telephone, electronic mail, text message, or websites. Automated mechanisms can also be employed to quickly and thoroughly disable access to system resources after an employee is terminated.
Organization-defined parameters (3)
Assessment objectives and methods
[Organization-defined: automated mechanisms] are used to [Organization-defined: ps-04.02_odp.02].
Examine
- Personnel security policy
- procedures addressing personnel termination
- system design documentation
- system configuration settings and associated documentation
- records of personnel termination actions
- automated notifications of employee terminations
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with personnel security responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for personnel termination
- automated mechanisms supporting and/or implementing personnel termination notifications
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.