Personnel termination is the controlled removal of a user’s organisational access when employment or a contract ends. It should trigger prompt account disablement, badge return, device recovery, key and token revocation, and review of delegated access or shared accounts. Gaps in offboarding leave active accounts, orphaned access and lingering trust relationships that former staff or contractors can exploit.
What personnel termination is meant to control
personnel termination is not just an HR event, it is an access reset. The operational goal is to ensure the former employee or contractor can no longer authenticate, reuse delegated access, or rely on any trusted path that was created during employment. In practice, that means closing every path that can still act on the organisation’s behalf, not just disabling the main login.
The process is broader than account disablement because people often accumulate access through multiple systems, badges, VPN, SaaS apps, shared operational tools, and emergency or delegated privileges. A clean termination process treats those access paths as a single exposure surface and removes them in a coordinated way.
That is why many teams treat termination as part of Joiner-Mover-Leaver (JML) Guide rather than a standalone admin task. The same lifecycle thinking also appears in the IAM and IGA Basics guide, where removal of access, entitlement review, and identity governance are treated as linked controls.
What has to happen during offboarding
A strong termination workflow should disable or revoke the access that can still be used after employment ends, then recover anything that can be physically or digitally reused. The direct answer already covers the core steps: account disablement, badge return, device recovery, key and token revocation, and review of delegated access or shared accounts. The practical point is sequencing, because lingering tokens or shared credentials can keep access alive even after the primary account is closed.
Shared mailboxes, service accounts, VPN profiles, API keys, SSH keys, session tokens, and device trust are common places where offboarding fails. If a person used administrative shortcuts, temporary access, or cross-team delegation, those grants need to be explicitly identified and removed rather than assumed to disappear with the primary login.
Termination also needs a reliable inventory of where the person had access. Without that, teams often disable the obvious identity but miss a federated login, a secondary SaaS tenant, a Git or CI/CD token, or an external partner portal. The NHI Lifecycle Management Guide is useful here because it frames offboarding as part of a broader lifecycle discipline, including revocation and visibility.
Why weak termination leaves lasting security exposure
The main security failure is not simply that an account stays open. It is that a former user may still hold a trusted artefact, such as a token, signing key, device session, or shared credential, that outlives the employment relationship. That creates a post-termination trust gap, especially when the person was involved in cloud administration, developer tooling, finance systems, or other high-trust workflows.
A useful way to think about the problem is that termination is both access removal and compromise containment. If the offboarding process is slow or incomplete, the organisation may not only preserve unnecessary access, it may also preserve the ability to act under the former identity’s trust chain. The practical lesson is that termination controls need to cover all access-bearing material, not just directory accounts.
When termination gaps involve keys or signing material, the issue becomes more than account hygiene. The access path can survive independently of the user record, so revocation, rotation, and replacement of sensitive material matter as much as disabling the account itself. That is why Coupang Signing Key Breach is relevant as a cautionary example of why unresolved access material can remain dangerous after offboarding.
Risk and Threat Considerations
Termination gaps create a real threat surface because former staff or contractors may retain enough access to browse data, move laterally, trigger automation, or abuse shared credentials. Even when the person is not malicious, stale access can be harvested by an attacker who obtains their old credentials, session material, or a reused token.
Failure mechanism: The organisation disables the primary account but leaves one or more secondary access paths active, such as federated sessions, shared accounts, API keys, cached tokens, device trust, or delegated privileges. Those paths can continue to authenticate or authorise actions after the employment relationship has ended.
Impact: Former insiders, compromised former accounts, or attackers with reused material can access sensitive systems, alter records, exfiltrate data, or create persistence that is harder to detect than a normal external intrusion. The longer the delay between termination and full revocation, the more time there is for misuse or dormant access to be activated.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Termination requires prompt disabling and removal of user access across systems. |
| IA-5 — Authenticator Management | Revoking keys, tokens, and other authenticators is central to offboarding control. | |
| PS-4 — Personnel Termination | This control directly addresses separating personnel and removing organizational access at termination. | |
| Recommendation — Disable terminated accounts and remove all associated access rights without delay. Revoke or rotate authenticators, tokens, and secrets issued to departed users. Execute personnel separation procedures that revoke access and recover organizational assets. | ||
| CIS Controls v8 | 5 — Account Management | Offboarding depends on timely account removal and control of active access paths. |
| 6 — Access Control Management | Termination must eliminate remaining permissions, sessions, and access routes. | |
| Recommendation — Remove or disable accounts and review all inherited or shared access on termination. Enforce revocation of access rights, sessions, and shared credentials when personnel depart. | ||
Practitioner Guidance
What to prioritise: Start with access paths that can still authenticate independently of the human account, especially shared credentials, privileged roles, API keys, device trust, and delegated admin access. Those are the controls most likely to survive a simple directory disablement.
What to verify: Confirm that offboarding evidence exists for the full access set, not just the HR record. Good evidence includes account disablement timestamps, token and key revocation records, badge return, device recovery, and an owner review of any shared or inherited access that the person used.
Common mistake: Treating offboarding as complete once the main identity is disabled. In practice, the residual risk often sits in access artefacts, automation credentials, and cross-system trust relationships that are easy to miss unless the process is explicit and repeatable.
Practitioner takeaway: The control objective is not to remove a username, it is to remove every way that identity can still act. If any trusted path remains live after termination, the offboarding is not finished.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org