Access Deactivation Procedures When Employment Ends

A clear, automated access deactivation procedure is one of the simplest and most effective measures to reduce the risk associated with former employees: once the departure date is confirmed, all of the employee's accounts (email, internal systems, VPN, cloud applications) should be deactivated in a coordinated way within a defined time frame, ideally on the day they leave. Relying on each system being revoked manually by different people is the most common cause of "zombie" accounts that remain active weeks or months after someone left the organization. Having a standardized checklist and, where possible, a centralized identity management system that deactivates everything from a single point eliminates much of this structural risk.