Establish an Access Revoking Process
Description
Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails.
Implementation Checklist
Tool Recommendations
Identity governance and administration platform with access certification, lifecycle management, and AI-driven access intelligence
SailPoint · Per-identity subscription
Cloud identity and access management with SSO, MFA, conditional access, and identity governance
Microsoft · Per-user subscription (P1/P2)
Cloud identity platform providing SSO, adaptive MFA, lifecycle management, and API access management
Okta · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Terminated Employee Retains System Access
ConfidentialityA terminated employee retains access to enterprise systems for days or weeks after departure because no revocation process exists, enabling data theft or sabotage out of retaliation.
Contractor Access Persists After Engagement Ends
ConfidentialityThird-party contractor accounts remain active indefinitely after their engagement ends because no revocation process triggers deprovisioning when the business relationship terminates.
Privilege Accumulation Without Revocation on Role Change
IntegrityUsers who change departments or roles retain their previous access in addition to new role permissions, gradually accumulating excessive privileges across the enterprise.
Vulnerabilities (When Safeguard Absent)
No Formal Access Revocation Process
Without a defined process for revoking access upon termination or role change, accounts remain active and privileged long after the user's authorization has ended.
No Integration Between HR and IT for Deprovisioning
Without automated or procedural links between HR termination events and IT account deprovisioning, there is no trigger to disable accounts when users leave the organization.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |