PS-4: Personnel Termination

Quick-reference card

What this control requires

PS-04 requires organizations to revoke every form of system access, retrieve credentials, and conduct exit interviews the moment an employee is terminated. This control addresses one of the most exploitable gaps in security operations: the window between HR processing a termination and IT actually disabling the individual’s access.

The control mandates five specific actions. First, you must disable system access within a defined time period after termination. Second, all authenticators and credentials associated with the individual must be terminated or revoked. Third, the organization must conduct exit interviews that cover security topics, including non-disclosure agreement obligations and any post-employment restrictions. Fourth, all security-related property must be retrieved, including hardware tokens, keys, badges, and manuals. Fifth, you must retain access to organizational information and systems formerly controlled by the terminated individual to maintain operational continuity.

The operational stakes here are significant. The gap between HR termination and IT access revocation is one of the most common insider threat vectors, and adversaries who understand organizational offboarding processes know exactly how to exploit it. Without a tightly coordinated process, terminated employees can retain access to critical systems for hours, days, or even months. This control works in direct coordination with Account Management (AC-02), which governs the full account lifecycle. PS-04 triggers the termination phase of that lifecycle.

Why it matters

Most organizations treat offboarding as an HR workflow, not a security operation. That disconnect is exactly what makes personnel termination one of the highest-risk moments in any security program. A terminated employee who retains access, even briefly, has both motive and means to cause damage.

The real threat isn’t the standard account that gets disabled on schedule. It’s the access no one knows about: service accounts, shared credentials, tokens provisioned under alternate identities, and SaaS logins that bypass centralized directory management. These are the vectors that survive a standard offboarding checklist.

Gucci network sabotage

Sam Chihlung Yin worked as a network engineer at Gucci’s IT operations center in Secaucus, New Jersey. In May 2010, Gucci fired Yin for abusing his employee discount by purchasing products in bulk and reselling them in Asia. Before his termination, Yin created a fictitious employee account and provisioned a VPN token under that fabricated identity. Because the token wasn’t registered under his own name, standard offboarding procedures had no reason to revoke it.

Six months later, on November 12, 2010, Yin used the ghost account to log into Gucci’s network. Over approximately two hours, he deleted virtual servers, wiped storage area network arrays, and destroyed the disk containing corporate email mailboxes. The damage exceeded $200,000 in lost data, restoration labor, and productivity losses.

The case is a textbook PS-04 failure. Gucci terminated the employee but didn’t terminate the access he had created for himself. A Manhattan district attorney indicted Yin on 50 counts. He pleaded guilty in July 2012 to first-degree computer tampering and nine additional felony counts, receiving a sentence of two to six years in state prison. The case is regularly cited in insider threat training programs as a reminder that offboarding must account for all access an individual created, not just the access assigned to them.

What attackers exploit

• Ghost or orphaned accounts pre-staged before termination, registered under fabricated identities or service account names
• Delayed access revocation windows where terminated individuals retain valid credentials for hours or days after HR processes the separation
• Shared credentials and team passwords that survive individual termination because no one updates them
• Untracked personal devices with cached corporate credentials, session tokens, or saved VPN configurations
• Lack of a full account audit tied to departing individuals, leaving behind accounts the employee created or administered

How to implement

The most common implementation failure is the coordination gap between HR and IT. When termination events aren’t automatically communicated to the systems responsible for access revocation, delays are inevitable and exploitable.

For your organization

Start by establishing an automated offboarding workflow triggered directly by HR system events. Manual handoffs between HR and IT introduce delays and create opportunities for error. Your identity provider or HR information system should generate a termination signal that initiates access revocation across all connected systems without requiring someone to remember to file a ticket.

Define the time window for access revocation explicitly in your personnel security policy. Best practice is same-day revocation for voluntary departures and pre-notification revocation for cause-based terminations, where IT disables access before the employee is informed. This eliminates the window for retaliatory action.

Build a termination checklist that covers every access vector: directory accounts, VPN credentials, email, SaaS applications, physical badges, hardware tokens, and any shared passwords the individual had access to. Shadow IT and unmanaged SaaS applications are frequently missed because they don’t appear in the organization’s centralized identity directory.

Conduct exit interviews that go beyond logistics. These interviews must cover NDA reminders, post-employment restrictions on information use, and the return of all organizational property. For involuntary terminations, skipping the exit interview is a common mistake that eliminates a critical control point.

Audit all accounts created by the departing individual, not just accounts in their name. This is the core lesson from the Gucci case. A network administrator, developer, or IT staff member may have provisioned service accounts, test accounts, or system accounts that won’t appear on a standard offboarding checklist.

Retain access to the terminated individual’s files, email, and systems so the organization maintains continuity. Log and timestamp every revocation action to create an auditable evidence trail.

Common mistakes to avoid:

• Only revoking accounts registered in the employee’s own name
• Failing to revoke access to SaaS and shadow IT applications outside centralized directories
• Not coordinating with physical security for badge, key, and access card return
• Skipping exit interviews for involuntary terminations, assuming they’re unnecessary or too confrontational

ISO 27001 control 5.18 on access rights provides complementary guidance on the timely adjustment of access rights when employment changes.

For your vendors

When assessing vendors against PS-04, your questionnaire should probe for specific operational details. Ask: “What is your access revocation service-level agreement upon employee termination?” and “Do you audit accounts created by departing staff, or only accounts assigned to them?”

Request evidence beyond policy documents. Ask for termination procedures, sample offboarding checklists, and access revocation logs showing timestamps. Policy documents tell you what a vendor intends to do. Logs tell you what they actually did.

Red flags during vendor assessment include the absence of any documented offboarding procedure, manual-only processes with no HR-to-IT integration, and an inability to produce evidence of account audits tied to specific terminations. If a vendor can show you a policy but not a completed checklist or timestamped log, their control is likely a paper exercise.

Verification should go beyond documentation review. Ask the vendor to demonstrate that they’ve cross-referenced terminated employee lists against active account inventories within a defined period. Request evidence of terminated employee account audits rather than accepting a statement that offboarding procedures exist. The distinction between having a policy and enforcing it is exactly where PS-04 failures occur.

Evidence examples

Cross-framework mapping

Related controls

The Personnel Security family includes several controls that work alongside PS-04:

• AC-02 — Account Management: Governs the full account lifecycle including creation, modification, and removal. PS-04 triggers the termination phase of this lifecycle.
• IA-04 — Identifier Management: Manages the assignment and revocation of user identifiers. PS-04 requires revocation of all identifiers upon termination.
• PE-02 — Physical Access Authorizations: Controls physical entry to facilities. PS-04 requires retrieval of badges and keys when employment ends.
• PM-12 — Insider Threat Program: Establishes the organizational program for detecting and responding to insider threats. PS-04 is a key preventive control within that program.
• PS-06 — Access Agreements: Requires signed agreements covering security responsibilities. Exit interviews under PS-04 reinforce those obligations upon departure.
• PS-07 — External Personnel Security: Extends personnel security requirements to contractors and third parties, including those covered under NIST SP 800-171. PS-04 principles apply when external engagements end.

Frequently asked questions

What is NIST SP 800-53 PS-04

PS-04 is the NIST SP 800-53 control that requires organizations to protect information systems by revoking all access, credentials, and property when an individual’s employment ends. The control specifies five sub-requirements: disabling system access within a defined time period, terminating or revoking all authenticators and credentials, conducting exit interviews that address security topics and NDA obligations, retrieving all security-related organizational property such as hardware tokens and badges, and retaining access to information formerly controlled by the terminated individual. These requirements apply across LOW, MODERATE, and HIGH baselines, making PS-04 a foundational control regardless of system categorization.

What happens if PS-04 is not implemented

Terminated employees retain active credentials and can access organizational systems after their employment ends. Ghost accounts and orphaned credentials accumulate across your environment, creating persistent insider threat vectors that standard monitoring may not detect. The Gucci network sabotage case illustrates the consequences directly: a terminated network engineer used a pre-staged ghost account to destroy virtual servers and corporate email six months after his firing, causing over $200,000 in damage. PS-04 failures also create audit findings across all three baselines, since the control is required at LOW, MODERATE, and HIGH impact levels.

How do you audit PS-04

Auditors verify PS-04 by examining completed termination checklists and cross-referencing HR termination dates against account disable timestamps in directory service logs. They review signed exit interview records to confirm that NDA obligations and post-employment restrictions were discussed. Property return receipts are checked to verify that hardware tokens, badges, and keys were collected. Auditors also test for orphaned accounts by comparing the active account inventory against the current HR employee roster, looking specifically for accounts that should have been disabled but weren’t.

How quickly must access be revoked after employee termination

PS-04 requires organizations to define their own time period for access revocation rather than mandating a universal deadline. Your personnel security policy must specify this window, and you must demonstrate that revocations consistently happen within it. Best practice is same-day revocation for voluntary departures and pre-notification revocation for cause-based terminations, where IT disables all access before the employee is informed of the separation. The defined time period should reflect the sensitivity of the systems the individual accessed and the assessed risk of delayed revocation.