Guide · 3 min read

Proving a leaver lost access

Why "we removed their account" is one of the most common audit findings, and what proof looks like.

Why auditors ask

Access left open after someone leaves is a classic path to a breach, so SOC 2, ISO 27001, NIST SP 800-171 and HIPAA all expect access to be removed promptly and the removal to be recorded.

What proof looks like

Proof is a record, made at the time, of each system the person could reach and when the removal was confirmed, signed so it cannot be changed later. Offboarding Proof checks the connected systems when you run a check (reading their current state) and produces that signed, time-stamped record.

← All guides