Managing the Risks of Contentious Departures (Insider Risk)

A contentious departure, whether a dismissal or an exit on bad terms, significantly raises the risk that an employee with system access will act maliciously before leaving: downloading confidential information, sabotaging systems or leaving access open for later use. That's why, in these cases, it's advisable to coordinate in advance and confidentially between HR, security and legal, so access revocation happens at the same time as, or even before, the formal communication of the departure, and not hours or days later. Monitoring unusual activity in the weeks before a departure known in advance, such as mass file downloads, is a reasonable preventive practice for roles with access to especially sensitive information.