Which policy action is appropriate when an employee leaves the company?

Which policy action is appropriate when an employee leaves the company?

• A. Review all access permissions.
• B. Retrieve data from the employee if appropriate.
• C. Do nothing until the next audit.
• D. Terminate access and reset all passwords.

Answer: (D)

When an employee leaves, the immediate priority is to cut off their access to every system and data source. The best action is to terminate their access and reset all passwords. This approach instantly revokes any active sessions and prevents the former employee from re-entering with old credentials, which is crucial for protecting sensitive information and maintaining security hygiene. It also covers accounts that might be shared or have elevated privileges, ensuring no lingering access remains. Other steps are still important in broader offboarding processes, but they don’t address access control as directly. Reviewing permissions is part of ongoing management, but it doesn’t stop access right away. Retrieving data should follow policy and only as allowed, not as a primary security action for offboarding. Doing nothing until a future audit creates a window for potential misuse. Therefore, the immediate de-provisioning and password resets is the appropriate action.

When an employee leaves, the immediate priority is to cut off their access to every system and data source. The best action is to terminate their access and reset all passwords. This approach instantly revokes any active sessions and prevents the former employee from re-entering with old credentials, which is crucial for protecting sensitive information and maintaining security hygiene. It also covers accounts that might be shared or have elevated privileges, ensuring no lingering access remains.

Other steps are still important in broader offboarding processes, but they don’t address access control as directly. Reviewing permissions is part of ongoing management, but it doesn’t stop access right away. Retrieving data should follow policy and only as allowed, not as a primary security action for offboarding. Doing nothing until a future audit creates a window for potential misuse. Therefore, the immediate de-provisioning and password resets is the appropriate action.