NIST SP 800-53 control PS-4, Personnel Termination, has five parts: disable system access within a period you define, revoke the person's credentials, hold exit interviews on defined security topics, retrieve security related property such as tokens and keys, and keep organizational access to what they controlled. Here is how engineering teams can turn that into a checklist.
The five parts in engineering terms
| PS-4 element | What it means for a developer |
|---|---|
| Disable system access within a defined time | Suspend SSO, which cascades to most tools |
| Revoke credentials and authenticators | Remove tokens, SSH keys, API keys, MFA devices, signing keys |
| Exit interview on security topics | Cover what they hold, what they know, what they must return |
| Retrieve security related property | Laptop, hardware security keys, badges, any physical token |
| Retain access to information they controlled | Transfer mailbox, files, repositories and runbooks to a manager or team |
The summary above follows the control's published text as presented in the CSF Tools reference of NIST SP 800-53 Rev. 5. Read the official NIST publication for the exact wording before quoting it in a policy.
Enhancements to know about
PS-4(1) covers post employment requirements: telling the person about legally binding obligations to protect organizational information and getting an acknowledgment. PS-4(2) covers automated actions, using automated mechanisms to notify designated people of terminations or to disable access. According to the reference, PS-4(2) appears in the High baselines, while PS-4(1) is in no baseline. Check your own baseline before assuming either applies.
The supplemental guidance also notes that timely action matters most for terminations for cause, and that some organizations disable accounts before informing the individual. Exit interviews are not always feasible, so have a fallback such as a written acknowledgment.
Turning it into a runbook
- Define the time. "Within a defined period" means you pick it. For departures for cause, make it immediate.
- Automate the first step. Tie the HR termination event to identity provider suspension.
- List credentials by type. Personal tokens, shared secrets, deploy keys, CI variables, cloud keys.
- Assign a rotator for shared secrets the person could read.
- Prepare the exit conversation. A short script: what company data is on personal devices, what accounts they created with work email, what outstanding access requests exist.
- Collect equipment. Track serial numbers and return dates.
- Transfer ownership of everything they were the sole owner of.
- Close the ticket with timestamps. Those timestamps are your audit evidence.
What auditors tend to sample
Auditors usually pick a set of leavers and ask for the termination date, the date access was removed, and proof of both. A gap between them needs an explanation. Keeping the ticket, the identity provider log and the equipment return record together makes this a short conversation.
Not legal advice
PS-4(1) touches obligations that depend on jurisdiction and contracts. Ask counsel what your acknowledgment should say. This post only maps the technical control.
Quick check
Does PS-4 name a number of hours for removing access?
No. It says within an organization defined period, so set your own and write it down.
Is an exit interview mandatory?
The control includes it, but guidance accepts that it is not always feasible. Use a written fallback.
Safeguard's compliance and evidence automation can help you collect termination evidence for audits, and asset discovery helps you see which systems a leaver could reach. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
