A leaver ticket should record the notice date, last working day, each system and when access was removed, who removed it, proof such as a log link or screenshot, credentials rotated, equipment returned, and any exception with an approver. If an auditor samples ten leavers, the ticket alone should answer their questions.
Why the ticket is the real control
A procedure that lives in someone's head cannot be evidenced. A ticket created automatically from the HR event, with a standard task list, does two jobs: it makes sure the steps happen, and it leaves the record that shows they did.
NIST SP 800-53 PS-4 expects access to be disabled within an organization defined period, credentials revoked and security related property retrieved. The period is yours to set, and your ticket is where you prove you met it.
Fields to include
| Field | Why it matters |
|---|---|
| Person, role, manager | Identifies the case |
| Notice date and last day | The clock for your defined period |
| Reason category | Voluntary or for cause, which affects urgency |
| Identity provider suspension time | The primary control point |
| System list with removal time | Cloud, source host, CI, registries, tools |
| Token and key actions | Revoked, rotated or transferred |
| Shared secrets rotated | Which, by whom, when |
| Ownership transferred | Repos, services, alerts, CODEOWNERS entries |
| Equipment returned | Serial numbers and dates |
| Exit conversation done | Or the reason it was not |
| Exceptions | Reason, approver, end date |
| Closure sign off | Manager and security |
Make it automatic where you can
- Trigger creation from the HR system on the notice event.
- Pre populate the system list from your access records.
- Link directly to logs, such as the identity provider event for suspension.
- Use standard sub tasks with owners and due dates tied to the last day.
- Block closure until every sub task is complete or has an approved exception.
- Report on open and late leaver tickets weekly.
Measuring timeliness
Compute the gap between last day and access removal for every ticket. A few outliers with reasons are normal. A drifting average is a signal that a step is manual and being missed. Many auditors ask about exactly this gap.
Common gaps found in samples
- The identity provider account was suspended, but a local account in a tool remained.
- Tokens and deploy keys were not on the list.
- The ticket shows completion but no proof.
- The last day was changed and the ticket was not updated.
- Contractors were not included in the process at all.
Try it yourself
Use the framework mapping demo to see how a single control can satisfy several frameworks, so one ticket serves many audits.
Click through it at your own pace, or open it full screen.
Quick check
How fast must access be removed?
NIST PS-4 says within an organization defined period. Set yours, write it down and measure against it.
Do contractors need a leaver ticket?
Yes. Use the same process, since their access is often broader than expected.
Safeguard's compliance and evidence automation can help collect and organize this evidence. A free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
