Joiner, mover, leaver: a procedure for access changes

A joiner, mover, leaver procedure links every change in someone's employment to a matching change in their access. Joiners get a role-based starting set, movers lose old access when they gain new, and leavers lose everything within a time you define.

Why movers are the weak point

Joiners and leavers get attention. Movers do not. Someone moves from support to engineering, gets new access, and keeps the old. After a few years they hold a union of every role they ever had.

NIST SP 800-53 AC-2 asks organisations to notify account managers when users are terminated or transferred, or when a user's need-to-know changes. Transfers are named next to terminations on purpose.

Joiner steps

1. HR or the hiring manager files the request with role, start date and manager.
2. The account manager creates accounts from a role template, not from a copy of a colleague's access.
3. Anything beyond the template needs an approval from the system owner.
4. The new person reads and acknowledges the acceptable use rules before access is turned on. See the acceptable use acknowledgment post.

Role templates matter. They make approvals fast and make reviews easy, because you compare a person to their role instead of to nothing.

Mover steps

1. The manager or HR files a transfer with the effective date.
2. The account manager applies the new role template.
3. The old role's access is removed on the same date, unless the system owner approves a time-limited overlap with an end date.
4. Privileged access is re-justified, not carried over.

The overlap rule is the useful one. Handovers are real, so allow them, but give them an expiry that is recorded.

Leaver steps

NIST SP 800-53 PS-4 covers termination. In paraphrase: shut off system access within a timeframe you set, invalidate every credential and authenticator tied to the person, hold an exit conversation on security topics, collect organisation equipment, and keep control of information and systems the person managed.

Turn that into a checklist:

• Disable the identity provider account, which cuts single sign-on access.
• Revoke sessions and tokens, and API keys the person created.
• Rotate shared secrets they knew. AC-2 says to change shared or group authenticators when a member leaves.
• Transfer ownership of documents, repositories and automations.
• Collect devices.

Define the timeframe in the policy. "Same business day for voluntary exits, immediately for involuntary" is a clear rule. Pick yours.

Prove it worked

Once a quarter, compare the HR leaver list to active accounts across your main systems. Anyone on both lists is a finding. This simple reconciliation catches more than most tooling does, and it produces evidence an auditor will accept.

Safeguard's compliance and evidence automation can help gather the records from connected systems, though the HR trigger and the approval rules remain yours to define.

Quick check

Sources

• AC-2 Account Management, NIST SP 800-53 Rev. 5
• PS-4 Personnel Termination, NIST SP 800-53 Rev. 5

Last reviewed: 19 October 2026.