03.09.02 Personnel Termination...

This policy outlines procedures for managing system access rights upon employee termination, reassignment, and transfer within the organization, ensuring the confidentiality, integrity, and availability of controlled unclassified information (CUI). It addresses the timely deactivation of accounts, revocation of credentials, and the appropriate adjustment of access authorizations to align with evolving job responsibilities.

• A.03.09.02.ODP[01]: the time period within which to disable system access is defined.
• A.03.09.02.a.01: upon termination of individual employment, system access is disabled within <A.03.09.02.ODP[01]: time period>.
• A.03.09.02.a.02[01]: upon termination of individual employment, authenticators associated with the individual are terminated or revoked.
• A.03.09.02.a.02[02]: upon termination of individual employment, credentials associated with the individual are terminated or revoked.
• A.03.09.02.a.03: upon termination of individual employment, security-related system property is retrieved.
• A.03.09.02.b.01[01]: upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is reviewed.
• A.03.09.02.b.01[02]: upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is confirmed.
• A.03.09.02.b.02: upon individual reassignment or transfer to other positions in the organization, access authorization is modified to correspond with any changes in operational need.