What should teams do when an employee’s digital access is revoked but badge access remains active?

Treat it as a lifecycle failure, not a narrow facilities issue. The identity has not been fully offboarded until both digital and physical rights are removed, exceptions are documented, and the remaining access path is reviewed for whether it reflects a valid business need or a control breakdown.

When digital access is revoked, why badge access still matters

The key issue is that the offboarding event is incomplete. A revoked login does not remove the person’s ability to enter spaces, reach devices, or interact with staff and assets if badge credentials still work. That mismatch creates a lingering trust path that can be abused accidentally or deliberately, so teams should treat it as a single identity lifecycle problem, not separate IT and facilities tasks.

Practically, this means the remaining physical credential should be checked against the person’s role, departure status, and any approved exception. If there is no documented business need, badge access should be removed or time-bounded immediately, and the asset owner should confirm that the physical access path is no longer a back door into systems, rooms, or support processes.

What a complete offboarding decision should include

A complete decision has three parts: confirm the digital revocation, verify whether the badge is still active, and decide whether the remaining physical access is justified. The point is not just to close an account, but to ensure the former employee no longer holds any effective privilege that could be used to reach sensitive areas, recover shared devices, or bypass other controls.

This is also where exception handling matters. If badge access must remain active for a short transition period, it should be explicitly approved, time-limited, and visible to the teams that can revoke it. Otherwise, the organisation ends up with an orphaned access path that no one owns end to end, which is exactly how lifecycle gaps persist.

Confirm the personnel status change and the revocation timestamp.
Check whether any badge, door group, or physical exception remains active.
Document the business reason, owner, and expiry date for any remaining access.
Reconcile the physical access record with the digital identity record after closure.

Why this gap becomes a control failure, not just a process delay

When badge access survives digital offboarding, the organisation has not fully removed the person’s authority. That creates a security gap because physical access can support tailgating, unattended device access, or informal requests that bypass normal approvals. It also weakens accountability, since investigations and reviews may show a “closed” identity while the person still had a valid way back into the environment.

Teams should consider whether the badge process is operating on a different lifecycle than IAM. If those systems do not share revocation triggers, review cadence, and exception ownership, the control failure will repeat across other joiner, mover, and leaver events. NHI Lifecycle Management Guide is useful here because it reinforces the broader principle that lifecycle closure must be complete, not partial. For control references, CIS Controls v8 and NIST SP 800-53 Rev 5 Security and Privacy Controls both support disciplined access governance and review of access rights.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Badge access is a credential lifecycle issue that must be revoked when employment ends.
	AC-2 — Account Management	The question is about completing identity offboarding across digital and physical access.
Recommendation — Revoke and expire badge credentials promptly when offboarding closes. Synchronize account termination and access removal across all systems.
CIS Controls v8	CIS-6 — Access Control Management	Active badge access after digital revocation is an access control gap needing review.
Recommendation — Review and remove lingering physical access rights during offboarding.
ISO/IEC 27001:2022	A.5.18 — Access rights	Residual badge access after departure is a failure to withdraw access rights cleanly.
	A.8.5 — Secure authentication	Badge credentials function as authentication material and must be disabled when no longer needed.
Recommendation — Withdraw physical and logical access rights as part of leaver processing. Disable badge authenticator use once access is no longer justified.

Practitioner Guidance

What to verify: Do not trust a “revoked” status until the badge system, visitor access, and any shared-site exceptions are all checked separately. The failure condition is usually a mismatch between systems, not a single bad decision.

Decision rule: If the badge still grants access after employment access is ended, treat it as an unresolved offboarding item unless a named owner has approved a short, documented exception with an expiry date.

What to prioritise: Reconcile the identity record and the physical access record first, then review whether the remaining access could reach secure areas, devices, or controlled handoff points. That sequence reduces the chance of leaving a usable access path in place while paperwork catches up.

Practitioner takeaway: The right standard is not “digital access removed,” it is “no remaining effective access without an explicit, time-bound business case.” If one side of offboarding is still open, the identity is still partially active.