Security responsibilities and duties that continue after someone leaves or changes job are to be defined, made known to the people and outside parties concerned, and enforced. Purpose: protect the organization's interests when employment or contracts change or end. Guidance: the leaver and mover process should state which security responsibilities stay in force, for instance keeping information confidential and respecting intellectual property and know-how gained in the job, and obligations under other confidentiality agreements (6.6). Continuing duties belong in the person's employment terms (6.2), contract or agreement, and other agreements that run on for a set period can also carry them. A change of role or employment is handled as ending the current role and starting the new one. Security roles held by a person who leaves or moves are identified and handed to someone else. A process tells staff, outside parties and relevant contacts about the changes and the operating procedures such as customers and suppliers. The same process applies to external personnel from suppliers when their engagement, contract or job ends or changes. Other information: HR usually runs the overall termination process together with the person's manager, and for supplier-provided staff the supplier runs it under its contract with the organization.
This control maps to 33 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 6.5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 33 it maps to, and the evidence behind each claim, over MCP and REST.