Offboarding for a SOC 2 Compliant Company: Access Removal and Audit Evidence Checklist
Offboarding from HR notice to a closed evidence file: revoke access, transfer information, recover equipment, and define IT responsibilities.
An employee is leaving, but you are unsure who removed their code access, who received their files, and what you can show an auditor. Offboarding at a company undergoing a SOC 2 examination means ending access, transferring responsibility, and recording completion to reduce lingering permissions and support the examination of controls. Completing it requires an agreed cutoff time, named owners, and evidence from every system within scope.
What does incomplete offboarding cost the business?
Incomplete offboarding leaves a risk of unauthorized access and creates investigation work when information or a service becomes unavailable. An active account can leave a route to business information; deleting it prematurely can make it harder to continue serving customers. If an automated process remains owned by the departing employee, disabling their account could stop it.
Even without a security incident, managers and IT staff waste time finding approvals and reconstructing what happened. The cost extends beyond an assigned license: it includes staff disruption, exception handling, and rebuilding evidence after the event. When choosing a provider, ask them to define what proves completion rather than relying on a ticket marked “resolved.”
How should offboarding support a SOC 2 examination?
A sound process connects an approved HR notice to an access inventory, revocation tasks, and verification. SOC 2 is a framework for examining controls at a service organization; criterion CC6.2 includes removing access credentials when access is no longer authorized, including for external users. CC6.3 addresses access aligned with roles, so a role change requires removing previous permissions that are no longer needed. These are controls examined during the engagement, rather than Israeli legislation. Source: AICPA criteria.
Define the trigger, cutoff time, and responsibilities
HR provides an approved notice identifying the person, their exact departure time, and the time zone. The manager approves who will take over information and services; IT owns its assigned technical tasks; information security defines verification and escalation. Apply the process to contractors and guests as well.
SOC 2 has no universal rule requiring access removal within 24 hours. Company management sets the execution window in its policy based on risk and contractual commitments, subject to applicable law. For a planned departure, prepare the handover beforehand; for immediate termination, coordinate revocation with the authorized decision-maker; for a role change, retain only permissions approved for the new role.
Israel imposes a separate obligation: regulation 9(c) of the Privacy Protection (Data Security) Regulations, 5777-2017 (תקנות הגנת הפרטיות (אבטחת מידע), התשע״ז-2017), requires revoking permissions immediately when the role ends and, where possible, changing passwords the departing person may know, for the database and systems to which it applies. An internal execution window does not postpone this obligation. Privacy Protection Authority guide.
Inventory and revoke access in every system
Map central identity, email, VPN, cloud infrastructure, code repositories, SaaS applications, local accounts, and physical access. SSO means signing into applications through a central identity; it does not prove that every application has ended existing access. Also inventory API keys, integration permissions, and shared passwords that need rotation.
In Microsoft Entra, open Entra ID > Users > All users, select the user, then under Account status > Edit clear Account enabled and save. Next, select Revoke sessions on the Overview page. A session is an existing authenticated connection; a token is a digital access credential, and revoking it centrally does not necessarily invalidate a session issued by the application itself. Revoke access within the application too, and verify the result. Microsoft instructions.
In GitHub, when membership is not managed through a SCIM integration, open Organizations > your organization > People, select the user, choose Remove from organization, and confirm. Also check membership in other organizations within the same Enterprise and access to internal repositories. Removal does not erase local code copies; remind departing personnel of their confidentiality and information-handling obligations. GitHub guide.
In Slack Free, Pro, and Business+ plans, go to Admin > Workspace settings > People, open the user menu, and select Deactivate account. In Enterprise, deactivate at the organization level; removing someone from a workspace alone leaves their organization membership intact. Slack instructions. For your VPN, separately check account revocation, termination of active connections, and revocation of personal certificates, as applicable to your product.
If you are evaluating a provider to support your business IT, start by discussing suitability with 1iT through its employee onboarding and offboarding service. Bring your system inventory and current procedure so the discussion focuses on gaps and responsibilities.
Transfer information and handle equipment and exceptions
Before deleting a Microsoft 365 account or removing its license, decide how email and files will be retained and who will receive business access. Microsoft’s former-employee guide separates blocking sign-in, retaining information, and transferring access. The technical ability to open a mailbox does not itself authorize reading its correspondence: agree on the approved access scope with legal counsel, considering the mailbox type and the policy communicated to employees. The principles of legitimacy, proportionality, and transparency in employment are described in a Ministry of Justice publication.
Record the return of computers, phones, entry badges, and security keys by asset identifier. For remote employees, arrange collection and assign someone to track it. For an unreturned computer, document any approved lock or wipe action and confirmation of actual execution; a submitted request is not proof of completion. Remote wiping depends on management capabilities and device connectivity, so do not assume an offline device has been wiped.
SCIM is a mechanism for synchronizing users between systems. Deactivation and log collection can be automated, but if synchronization fails, act directly in the application and verify again. An application outside SSO needs its own task; a service account owned by the departing person needs a new owner and planned secret rotation. Record late revocation at its actual time, including the failure’s cause, an exposure review, and corrective action; do not alter timestamps.
Close the evidence file, not just the ticket
Close an offboarding file after comparing the access inventory with completion evidence from every system. The following table is a template you can copy into a spreadsheet and export as CSV; create a separate row for each system and asset.
Action | System | Owner | Due date | Actual completion | Evidence | Verifier |
|---|---|---|---|---|---|---|
Disable identity | Identity provider | Assigned IT owner | As approved | Date, time, and time zone | Change log | Designated reviewer |
Revoke access | Each application separately | System owner | Per policy and law | Timestamp | Log and user status | Verifier |
Return equipment | Asset register | Operations | Agreed date | Receipt date | Asset identifier and confirmation | Asset owner |
Illustration only, rather than a customer case: an offboarding file contains an HR notice establishing the trigger and approved cutoff time; a service ticket bringing together tasks and owners; a system inventory defining the verification scope; and timestamped revocation logs showing what happened and when. A computer-return receipt identifies the asset received. Closure approval records who compared the evidence with the inventory, which exceptions remained, and who approved their handling.
How can 1iT fit into the process?
1iT manages, protects, and supports business IT; the scope of its offboarding responsibility should be defined in the engagement. When choosing the service, work through the following steps:
- Define which IT management and support needs you want to assign to 1iT.
- Document the included tasks in the proposal, along with those your team retains.
- Specify who at your company authorizes urgent offboarding, receives escalations, and may approve exceptions.
The company remains responsible for business decisions, policy, and approvals; the IT provider’s responsibility follows the agreement. If you have an internal team, also consider Co-Managed IT services. Ask the proposal to specify deliverables for verifying completion, without assuming that an IT service itself provides SOC 2 assurance.
Who should formalize this service?
Formalizing the service suits Israeli B2B companies where employee and contractor departures involve multiple systems and stakeholders. It is particularly relevant when management needs business continuity and documentation it can present during an examination, while no single person has visibility into all the tasks.