Responsibilities after termination or change of employment

Plain-language summary

Making sure the security duties that outlive a job — confidentiality, intellectual property, care of personal information — are defined, communicated to the person leaving or moving, and enforced, and that internal moves do not leave old access and obligations behind.

What the clause is really asking

Leavers and movers are a reliable source of data loss: people take customer lists to competitors, and long-serving staff accumulate access from every role they have held. This control asks you to define which information security duties stay in force after someone leaves or changes role, build them into the terms (6.2), remind the person of them at the time of the change, and act when they are breached. It also covers your side: telling customers, suppliers and banks the person dealt with that they no longer act for you. A change of role is handled as closing one set of responsibilities and opening another. The common misunderstanding is treating this as the IT leaver checklist; disabling accounts and collecting laptops sit under access rights (5.18) and return of assets (5.11), while this control is about the duties that continue and how they are communicated. In South Africa, confidentiality obligations generally survive termination, while restraint-of-trade clauses are tested separately for reasonableness, so do not rely on a restraint alone to protect information.

What auditors look for

Auditors ask for the leaver and mover procedure and sample people who left or changed roles in the period. For leavers they look for the exit letter or acknowledgement reminding the person of continuing confidentiality and intellectual property duties, then trace account disablement and asset return dates against the last working day. For movers they compare current access with the new role and look for access left over from the old one. They ask whether customers, suppliers and the bank are told when a key contact leaves. The hard question: show me the sales manager who resigned to join a competitor, and what you did.

Typical evidence

Leaver and mover procedure; contract clauses on continuing obligations; exit letters or acknowledgements of continuing confidentiality and intellectual property duties; exit interview records; account disablement and asset return records against last working day; mover access reviews; notifications to customers, suppliers and banks when an authorised contact leaves; records of action on suspected breaches after departure.

How to comply — recommendations

Write a one-page leaver and mover procedure that HR triggers, not IT. For leavers: a standard exit letter listing the duties that continue (confidentiality, intellectual property, personal information, return of all company information including copies on personal devices), handed over and acknowledged at the exit interview; a same-day trigger to IT and the asset owner; and notice to customers, suppliers and the bank where the person was an authorised contact. For movers: a role-change form that closes the old access before granting the new. For high-risk departures, such as a resignation to join a competitor, review recent downloads and mail-forwarding rules before the last day.

Common nonconformities

No defined continuing responsibilities in contracts or exit documents; leavers never reminded of confidentiality duties; movers keep access from previous roles; HR does not notify IT promptly, so accounts stay active after departure; customers and banks not told when an authorised contact leaves; contractors at the end of an engagement not handled the same way as staff.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.