What should teams do when an employee’s digital access is revoked but badge access remains active?

When digital access is revoked, why badge access still matters

The key issue is that the offboarding event is incomplete. A revoked login does not remove the person’s ability to enter spaces, reach devices, or interact with staff and assets if badge credentials still work. That mismatch creates a lingering trust path that can be abused accidentally or deliberately, so teams should treat it as a single identity lifecycle problem, not separate IT and facilities tasks.

Practically, this means the remaining physical credential should be checked against the person’s role, departure status, and any approved exception. If there is no documented business need, badge access should be removed or time-bounded immediately, and the asset owner should confirm that the physical access path is no longer a back door into systems, rooms, or support processes.

What a complete offboarding decision should include

A complete decision has three parts: confirm the digital revocation, verify whether the badge is still active, and decide whether the remaining physical access is justified. The point is not just to close an account, but to ensure the former employee no longer holds any effective privilege that could be used to reach sensitive areas, recover shared devices, or bypass other controls.

This is also where exception handling matters. If badge access must remain active for a short transition period, it should be explicitly approved, time-limited, and visible to the teams that can revoke it. Otherwise, the organisation ends up with an orphaned access path that no one owns end to end, which is exactly how lifecycle gaps persist.

• Confirm the personnel status change and the revocation timestamp.
• Check whether any badge, door group, or physical exception remains active.
• Document the business reason, owner, and expiry date for any remaining access.
• Reconcile the physical access record with the digital identity record after closure.

Why this gap becomes a control failure, not just a process delay

When badge access survives digital offboarding, the organisation has not fully removed the person’s authority. That creates a security gap because physical access can support tailgating, unattended device access, or informal requests that bypass normal approvals. It also weakens accountability, since investigations and reviews may show a “closed” identity while the person still had a valid way back into the environment.

Teams should consider whether the badge process is operating on a different lifecycle than IAM. If those systems do not share revocation triggers, review cadence, and exception ownership, the control failure will repeat across other joiner, mover, and leaver events. NHI Lifecycle Management Guide is useful here because it reinforces the broader principle that lifecycle closure must be complete, not partial. For control references, CIS Controls v8 and NIST SP 800-53 Rev 5 Security and Privacy Controls both support disciplined access governance and review of access rights.

Practitioner Guidance

What to verify: Do not trust a “revoked” status until the badge system, visitor access, and any shared-site exceptions are all checked separately. The failure condition is usually a mismatch between systems, not a single bad decision.

Decision rule: If the badge still grants access after employment access is ended, treat it as an unresolved offboarding item unless a named owner has approved a short, documented exception with an expiry date.

What to prioritise: Reconcile the identity record and the physical access record first, then review whether the remaining access could reach secure areas, devices, or controlled handoff points. That sequence reduces the chance of leaving a usable access path in place while paperwork catches up.

Practitioner takeaway: The right standard is not “digital access removed,” it is “no remaining effective access without an explicit, time-bound business case.” If one side of offboarding is still open, the identity is still partially active.

Related resources from NHI Mgmt Group

• How should security teams prioritize employee cyber risk signals across behavior, access, and active threats?
• What should teams do when employees leave but access still remains active?
• What is the difference between rotating a secret and revoking access?
• How should teams reduce the risk of orphaned service accounts and stale tokens?