What security questions belong in a departing developer's exit talk?

Ask the departing developer what company data and accounts they hold, what knowledge only they have, what property must be returned and what outstanding access exists. Keep it to about twenty minutes, use a written script, and record the answers. NIST PS-4 lists exit interviews on security topics as part of personnel termination.

What the control says

NIST SP 800-53 PS-4 includes holding exit interviews that cover organization defined security topics, and retrieving security related property such as tokens and keys. The supplemental guidance notes exit interviews are not always possible, for example when a departure is abrupt. So treat the conversation as valuable and have a written fallback.

The conversation is not a trap

The tone matters. People leaving are more likely to be honest about forgotten accounts if they do not feel accused. Say at the start that the aim is to avoid problems for the next owner and for them.

A script you can adapt

Accounts and access

1. Which tools did you sign up for with your work email, including trials?
2. Do you hold admin rights anywhere you think we may not know about?
3. Do you have any accounts for company systems under a personal email?
4. Are there shared passwords or tokens you use that we should rotate?

Data and devices 5. Is any company code, data or documentation on a personal device, personal cloud storage or a personal repository? 6. Do you have local clones of repositories on devices that are not company managed? 7. Do you have company data in chat exports, notes apps or email forwards?

Knowledge 8. What would break if you were unavailable tomorrow? 9. Are there scheduled jobs, manual steps or renewals that only you handle? 10. Which vendors or partners contact you directly?

Property 11. Which equipment do you hold: laptop, hardware security keys, phones, badges? 12. When and how will it be returned?

Acknowledgment 13. Do you understand your continuing obligations about company information? Have counsel decide what the acknowledgment says, since this part is a legal matter.

After the conversation

1. Write answers into the leaver ticket.
2. Act on each item. An undeclared account is a task, not a note.
3. Rotate any shared secret the person mentioned or could access.
4. Confirm returned items by serial number.
5. Close the ticket only when every question has an owner and a completion date.

When there is no conversation

For abrupt or contested departures, skip the talk and rely on the technical steps: suspend identity first, remove tokens and keys, review audit logs for unusual downloads, rotate shared secrets. NIST's guidance notes timely action matters most for terminations for cause.

Why questions find things tools miss

Tools list what exists in systems you manage. They cannot see a trial account signed up with a work address on a third party site, or a notes file with a password in it. Asking is the cheapest discovery method there is.

Quick check

Safeguard's asset discovery can help find systems and identities you did not know existed, which complements what people tell you. A free scan is available at gold.safeguard.sh/scan.

Sources

• NIST SP 800-53 Rev. 5, PS-4 Personnel Termination (CSF Tools reference)

Last reviewed: 19 October 2026.