Who is accountable when insider exfiltration occurs during offboarding?

Why This Matters for Security Teams

offboarding is one of the most sensitive points in the identity lifecycle because account closure, data return, device recovery, and access review often happen under time pressure. When insider exfiltration occurs at this stage, the issue is rarely a single control failure. It usually reflects a breakdown in coordination between HR, security, IT, and the data owner, with unclear ownership of monitoring, evidence collection, and escalation. Guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces that access control and auditability are operational responsibilities, not just policy statements.

Security teams often assume the business owner will notice unusual activity, while business teams assume security has already revoked every path to data. That gap is where exfiltration succeeds. The real challenge is not only who approved the offboarding, but who owned the final access verification, who watched for transfers, and who preserved logs once suspicion arose. In practice, many security teams encounter insider exfiltration only after a termination event has already been treated as routine, rather than through intentional offboarding risk controls.

How It Works in Practice

Accountability during offboarding should be mapped across three layers: procedural ownership, technical control ownership, and incident response ownership. HR typically owns the employment action and timing. The business owner or manager owns confirmation that data, devices, and obligations have been returned or reassigned. Security owns the control plane for access revocation, monitoring, and investigation. That division is consistent with the control intent in NIST guidance and with modern zero trust thinking, where access is continuously constrained rather than trusted until the end of employment.

In practice, a sound offboarding process includes immediate disablement of interactive access, timely token and key revocation, mailbox and file access review, and preservation of logs for later investigation. For privileged users and non-human identities tied to the departing worker, the review must also cover service accounts, API keys, shared secrets, and delegated access. Where a user had access to sensitive repositories or SaaS tools, the security team should check for recent bulk downloads, unusual forwarding rules, and external sharing before credentials are retired. CISA insider threat guidance is useful here because it treats exfiltration as a people, process, and technology problem rather than a pure disciplinary issue.

• HR confirms the departure trigger and timing.
• IT and IAM revoke accounts, sessions, and tokens.
• Security verifies logs, alerts, and anomalous access patterns.
• The business owner validates data return and successor handover.
• Legal or compliance joins if regulated data or litigation hold is involved.

Accountability becomes real only when each step has a named owner, a timestamp, and an evidence trail. NIST Zero Trust Architecture is especially relevant because it assumes access must be re-evaluated continuously, including during exit events. These controls tend to break down when offboarding is batch processed after hours and shared accounts, long-lived tokens, or unmanaged SaaS permissions remain active.

Common Variations and Edge Cases

Tighter offboarding controls often increase operational overhead, requiring organisations to balance speed of separation against the risk of overexposing data during the final hours of access. The practical answer also changes based on role type, jurisdiction, and data sensitivity. Best practice is evolving, but there is no universal standard for exactly how much monitoring is acceptable before a departure becomes an investigation.

For executives, engineers, and administrators, the accountability chain is usually broader because their access spans more systems and their activity may be harder to distinguish from legitimate bulk work. In remote or hybrid environments, device recovery and evidence preservation are harder, which raises the importance of immediate token revocation and cloud audit logs. If the departing individual was managing NHI such as deployment keys, bot accounts, or automation credentials, the ownership question extends to whoever approved and supervised those identities, because their persistence can outlive the human user. Where legal hold, union rules, or local labour law constrain timing, security may not be able to cut access first, but it still remains accountable for documenting compensating controls and monitoring for transfer activity.

For identity-centric environments, offboarding should be treated as a control transition, not just an HR event. The key question is not whether one team caused the exfiltration, but whether the organisation assigned clear operational responsibility before access could be abused. When that answer is vague, accountability usually gets decided after the breach, not before it.

Related resources from NHI Mgmt Group

• Who is accountable when a third-party identity is used in an insider incident?
• Who is accountable when workforce IAM controls fail during offboarding?
• Who is accountable when USB exfiltration happens in an insider-risk programme?
• Who should be accountable when pre-notice exfiltration occurs?