Organisations should treat offboarding as a security control, not an HR admin task. The first priority is to disable accounts, revoke passwords, terminate remote access, and remove shared credentials as soon as termination is confirmed. Delays create a window where former employees can copy data, misuse access, or help others bypass controls. Offboarding should also include review of cloud apps, VPNs, and delegated access.
Why offboarding must be handled as an access-control event
Offboarding reduces insider threat risk by shrinking the time between termination and loss of access. The practical objective is to remove the former employee’s ability to authenticate, reuse shared credentials, or reach business systems before they can copy data, tamper with records, or use unattended sessions. That means security and HR need a handoff that is immediate, ordered, and verified.
The first wave of removal should cover the paths most likely to remain active after a person leaves: account disablement, password and token revocation, VPN termination, and removal of delegated access. If access is left intact even briefly, the organisation is relying on trust in a relationship that no longer exists, which is exactly where insider risk grows.
For governance and lifecycle depth, Ultimate Guide to NHIs is useful because it treats lifecycle and offboarding as a control problem, not just an inventory problem. The same lifecycle logic also appears in Ultimate Guide to NHIs, Key Challenges and Risks, which helps frame why delayed revocation and excess access persist as a risk pattern.
If the employee had access to cloud applications, shared workspaces, production tooling, or delegated approvals, those routes need explicit review rather than assuming the main account disablement is enough. Offboarding is only complete when the organisation can show that the leavers’ access graph has been collapsed, not merely that a directory entry was deactivated.
What typically fails during offboarding
The most common failure is sequence. Teams often wait for equipment return, exit interviews, or manager confirmation before revoking access, which leaves a gap where the departing employee can still act with valid privileges. Another failure is partial revocation, where the primary account is disabled but shared passwords, API tokens, SSO sessions, or privileged group membership are missed.
Shared credentials are especially dangerous because they outlive the individual account and are often reused across systems. If a former employee knows a common password, a stale token, or a delegated workflow, the organisation may have removed the obvious account while leaving the real access path intact. That is why offboarding should include a review of both direct and indirect access paths, including cloud apps and any delegation chains.
A useful benchmark is the broader credentials risk pattern documented in OWASP Non-Human Identity Top 10, which highlights secret sprawl, overprivilege, and rotation failures as recurring causes of exposed access. For incident-driven context, The 52 NHI breaches Report shows how compromised credentials and weak lifecycle controls repeatedly become entry points for broader abuse.
One NHIMG data point is especially relevant here: only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them. That matters because access removal is only as complete as the least visible credential or token that remains valid after departure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS 5 — Account Management | Directly governs timely disablement and review of former-user access. |
| CIS 6 — Access Control Management | Supports removal of cloud apps, delegated access, and other remaining permissions. | |
| CIS 8 — Audit Log Management | Helps confirm offboarding actions and detect post-exit access attempts. | |
| Recommendation — Disable accounts promptly and verify all former-user access paths are removed. Revoke delegated and indirect access paths during offboarding. Retain logs to confirm revocation and investigate residual access use. | ||
| NIST CSF 2.0 | PR.AC — Identity Management, Authentication and Access Control | Covers access revocation, credential invalidation, and privilege removal after termination. |
| DE.CM — Continuous Monitoring | Supports detection of lingering sessions or post-termination access attempts. | |
| RS.MA — Mitigation | Applies when offboarding gaps require rapid containment and access shutdown. | |
| Recommendation — Remove access promptly and invalidate credentials when employment ends. Monitor for residual access and alert on use after offboarding. Treat delayed revocation as a containment issue and close access immediately. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Identity proofing and lifecycle assurance matter when offboarding depends on trusted identity records. |
| AAL — Authenticator Assurance Level | Authenticator revocation is part of stopping former users from re-authenticating. | |
| FAL — Federation Assurance Level | Federated SSO and delegated access must be revoked when offboarding spans SaaS and cloud apps. | |
| Recommendation — Use trusted identity records to ensure revocation targets the right subject. Revoke authenticators and sessions so departed users cannot reauthenticate. Remove federated access and trust relationships tied to the departed user. | ||
| NIST Zero Trust (SP 800-207) | 3.0 — Zero Trust Architecture Principles | Offboarding fits Zero Trust because access should be continuously re-evaluated and quickly removed. |
| Recommendation — Apply continuous access verification and revoke trust as soon as employment ends. | ||
Practitioner Guidance
What to verify: Confirm that termination triggers a defined revocation sequence, not a manual scramble. The key check is whether the organisation can prove that accounts, sessions, shared secrets, and delegated access were removed the same day the exit was confirmed.
Decision rule: If the departing employee can still authenticate anywhere, treat the case as incomplete offboarding and escalate it until the remaining access path is closed. If the person had privileged, cloud, or shared access, require a second-pass review of system-specific access that sits outside the main directory.
What good looks like: The organisation can show a timely deprovisioning record, evidence of token and session revocation, and a post-exit review of shared credentials and third-party app access. The control is working when no former employee retains a usable path after the termination event, even through indirect or delegated access.
Practitioner takeaway: The safest offboarding programmes assume that the real risk is not the obvious account, but the forgotten access path, so revocation has to be immediate, comprehensive, and independently verifiable.
Related resources from NHI Mgmt Group
- How can organisations reduce the risk of stale API keys and machine tokens?
- What should organisations do when an employee leaves to reduce residual risk?
- How should security teams reduce insider threat risk through access governance?
- How should organisations reduce the risk of social engineering attacks that bypass technical controls and target employee access instead?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
