They should define a shared workflow that uses HR status changes as the trigger for security action. HR should signal joins and departures, security should own access changes and monitoring, and managers should validate business logic for exceptions and approvals. This coordination creates a single process for provisioning, revocation, and insider-risk review instead of fragmented handoffs.
Why onboarding and offboarding fail when ownership is split
Onboarding and offboarding controls break down fastest when HR, security, and line managers each assume another team will close the loop. The real issue is not just process delay; it is inconsistent authority over who can start work, who can keep access, and who can be removed cleanly when status changes. A shared workflow turns employment changes into a security control point rather than an administrative afterthought.
For a broad governance view, the NIST Cybersecurity Framework 2.0 is useful because it frames identity lifecycle work as part of managed security outcomes, not isolated ticket handling. The practical mistake is treating onboarding as a one-time provisioning event and offboarding as a best-effort cleanup, which leaves access drift, delayed revocation, and unclear exception ownership. In practice, many organisations discover those gaps only after an employee change has already created an unnecessary access window.
What the first control should look like in day-to-day operations
The first improvement is to make HR status the system of record for lifecycle events and to connect that status to security action without delay. That means a joiner event should automatically create the need for provisioning, role validation, and approval routing, while a leaver event should start access removal, device recovery, and monitoring for residual access. Managers should not own execution, but they should own the business justification for exceptions, temporary access, and edge cases.
In practice, the workflow needs three things to work reliably:
- one trigger for join, move, and leave events, so the same person is not handled differently by different teams;
- clear ownership for each step, so HR signals status, security changes access, and managers validate business need;
- timed completion expectations, so revocation does not depend on manual follow-up after employment has ended.
That structure matters because onboarding and offboarding are lifecycle controls, not just paperwork. If the process is weak, the organisation can end up with orphaned accounts, stale entitlements, or former staff still able to reach systems that should already be closed. It also improves auditability because each change can be tied back to a specific status event, approver, and completion record. For organisations with many systems, this is where IAM integration and access review discipline become operationally necessary rather than optional. When the HR event is inconsistent, late, or not trusted, the whole workflow degrades into manual reconciliation and the control stops scaling.
Security teams should also separate standard cases from exceptions. A normal hire should follow the pre-approved path, but privileged access, urgent starts, contractor extensions, and same-day exits need explicit handling because they create the highest risk of access overlap. Managers should be required to justify those exceptions in business terms, not to decide security policy themselves.
Where the workflow needs tighter rules and clearer exception handling
Tighter lifecycle control often increases coordination overhead, so organisations have to balance speed against assurance. That tradeoff becomes visible when urgent hiring, internal transfers, or departures outside business hours collide with manual approvals and delayed system updates.
One common variation is the internal move, which is often missed because the person is not leaving the organisation but is still changing risk profile. Another is the contractor or third-party worker, where the end date may be less stable and the access scope narrower but more time-sensitive. For that reason, teams should not treat joins and leaves as binary events only; they should also handle transfers, extensions, and temporary elevated access as separate lifecycle states. The guidance here is to standardise the exception path, because ad hoc approvals usually create more inconsistency than risk reduction.
Security leaders should be especially careful not to let the process depend on informal manager memory or chat-based confirmation. The workflow should produce evidence that access was granted for a defined reason and removed when the reason ended. The question is not whether every edge case can be fully automated, but whether the organisation can prove that exceptions were deliberate, time-bounded, and reviewed. Where that evidence is missing, offboarding control often looks complete on paper while access still lingers in practice.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OV-01 — Oversight of Risk Management Strategy | Lifecycle access control needs clear ownership and governance across HR, security, and managers. |
| PR.AA-01 — Identity Proofing and Binding | Onboarding depends on establishing the right worker identity before access is granted. | |
| PR.AA-04 — Access Permissions Management | Offboarding and transfers require timely removal or adjustment of access rights. | |
| Recommendation — Assign lifecycle ownership and verify that joiner, mover, and leaver events trigger accountable security action. Bind new worker records to approved identities before provisioning access. Review and revoke access promptly when employment status changes. | ||
| CIS Controls v8 | 6.3 — Disable Dormant Accounts | Departed staff can leave behind active accounts if revocation is not enforced. |
| 6.4 — Access Approval and Review | Managers should approve exceptions and validate business need for elevated access. | |
| 5.1 — Establish and Maintain an Inventory of Accounts | Reliable joiner-leaver control depends on knowing which accounts exist and who owns them. | |
| Recommendation — Disable or remove accounts immediately when a worker no longer needs access. Require business approval and periodic review for exceptions and temporary access. Maintain a current account inventory to support onboarding and offboarding actions. | ||
| NIST SP 800-63 | AAL2 — Authenticator Assurance Level 2 | Lifecycle control is weakened if worker identities are not strongly bound to authenticators. |
| Recommendation — Use appropriately strong authenticators for worker access that must be provisioned and revoked cleanly. | ||
Practitioner Guidance
What to prioritise: Establish one lifecycle trigger path before you optimise provisioning speed. If HR status, security action, and manager approval are not linked, every downstream improvement will remain partial.
What to verify: Confirm that joins, transfers, and leavers all produce a tracked access outcome, not just a case record. Verify that the revocation path covers accounts, sessions, tokens, and any exception access that was granted during the employment period.
Common mistake: Treating offboarding as complete when the HR record is closed. That is usually where residual access survives, especially in systems that are not tightly integrated or in cases involving privileged or temporary access.
Practitioner takeaway: The best first step is not a new tool but a single operational rule: no employment status change should occur without a corresponding security action that can be checked, timed, and audited.
Related resources from NHI Mgmt Group
- How should security teams automate SaaS onboarding and offboarding without losing control?
- How should security teams implement group-based access control in environments with frequent onboarding and offboarding changes?
- How do security teams use user account history to improve offboarding and access control?
- Why do combined network and application permissions improve access control for internal services?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
