IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Personnel Remarks
____________________________________________________________________ .........................................
S 3.6 Regulated procedure as regards termination
of employment
Initiation responsibility: Head of Personnel Section; superiors; IT
Security Management
Implementation responsibility: Personnel Section; superiors
In case of termination of employment, the following should be observed:
- Before termination of employment, the designated successor of the
individual concerned must be given a briefing on the tasks.
- All documents, issued keys, borrowed IT equipment (e.g. laptops, data
media, documentation) must be recovered. In particular, agency/company
passes must be collected in from the staff member terminating his/her
employment.
- All entry and access rights held by the departing staff member must be
revoked or deleted. This includes external access authorisations over data
communications equipment. If, in exceptional cases, several persons shared
one access right to an IT system (e.g. by using a common password), the
access rights must be altered upon termination of employment by one of
those individuals.
- Before the person leaves, it should be explained to him explicitly one more
time that all confidentiality agreements remain in force and that no
information obtained in the course of his work may be disclosed.
- If the departing staff member was assigned any functions under a
contingency plan, the plan must be updated.
- All persons entrusted with security tasks, especially entrance control staff,
must be informed of the departure of the person.
- Individuals no longer employed with the agency/company must be denied
uncontrolled access to the agency/company premises, especially entry into
rooms housing IT systems.
- Optionally, all entry and access rights relating to IT systems may be
revoked even for the period from giving notice of termination to actual
termination of employment, and in addition, the individual concerned may
be prohibited from entering rooms requiring protection.
A useful way of doing this is to use inter-office slips which lay down the
various steps to be taken by a staff member before leaving the
agency/company.
Additional controls:
- Are regular provisions applied in case of termination of employment?
- Are the relevant bodies informed of the termination of service by a staff
member?
- What steps are taken to ensure that all entry and access rights of a staff
member terminating his/her employment are revoked and deleted?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000