PS-4 Personnel Termination covers what happens when someone's employment ends. It is one of the controls auditors test by sampling, because a leaver who still has access is easy to find and easy to explain to a customer. NIST 800-53 binds US federal systems, and other organizations meet it through contracts. For everyone else it is a reference for what good offboarding looks like.
What it means in practice
The statement in the record has five parts. Upon termination of employment you must:
- Disable system access within a time period you define.
- Terminate or revoke any authenticators and credentials tied to the person.
- Conduct exit interviews that cover topics you define.
- Retrieve all security related system property.
- Retain access to the organizational information and systems the person controlled.
That last item is easy to miss. If the departing engineer owned a service account, a shared mailbox or a set of files, the organization has to keep access to those. Disabling the person's account must not lock the company out of its own data.
The guidance notes that system property includes hardware tokens, technical manuals, keys, identification cards and building passes. It also says timely action matters most for people terminated for cause, and that in some cases organizations disable accounts before the person is told. Exit interviews may not always be possible, for example when the person is unavailable or abandons the job. The interview is a reminder of nondisclosure agreements and any limits on future employment.
The record lists two enhancements. PS-4.1 Post employment Requirements covers notifying the leaver of ongoing obligations. PS-4.2 Automated Actions covers using automation to notify and disable access.
Evidence to collect
- The offboarding policy, including the time limit for disabling access. Name a real number, such as same day or within four hours.
- A termination checklist template, and completed checklists for a sample of leavers.
- A list of leavers from HR for the audit period, matched against account disable timestamps in your identity provider, source control, cloud console and SaaS tools.
- Records of revoked credentials: API keys, SSH keys, tokens and certificates that were rotated or deleted.
- Asset return records for laptops, hardware keys and badges.
- Evidence of ownership handover for the leaver's files, mailboxes, repositories and service accounts.
- Exit interview notes or a signed acknowledgment of continuing confidentiality obligations.
Common gaps
- The identity provider account is disabled, but personal access tokens, deploy keys and local database users remain.
- HR and IT work from different dates. The leaver's last day is in one system and the disable timestamp is days later in another.
- Contractors are not on the HR list at all, so nobody offboards them.
- Shared secrets known to the leaver are never rotated.
- Nobody owns the leaver's service accounts, and the access quietly rots.
How to implement it
Start from the list of systems, not from the HR form. For each system, note how a person authenticates and where long lived credentials can exist. Then build one checklist with an owner per system and a deadline measured in hours.
Trigger the checklist from HR, not from a manager's email. Where you can, connect the HR event to the identity provider so the main account is disabled automatically, and treat the remaining systems as manual steps with sign off.
Add a monthly reconciliation. Pull the leaver list and compare it against active accounts in your five most sensitive systems. Anything left over is a finding to close and log.
Try it yourself
The access review demo shows how a periodic check catches accounts that outlived their owners.
Click through it at your own pace, or open it full screen.
Quick check
The leaver's single sign on account was disabled the same day. Is PS-4 satisfied?
Not by that alone. PS-4 also asks you to revoke authenticators and credentials, retrieve property and keep access to what the person controlled. Check tokens, keys and service accounts outside single sign on.
What if an exit interview cannot happen?
The guidance accepts that it may not always be possible. Record why, and send the confidentiality reminder in writing instead.
