A contractor still has access after leaving the project. What now?
Incomplete access offboardingNotify the responsible identity or security team and remove access through the approved offboarding process. Check shared resources, tokens, service accounts, and ownership transfers as well as the main login. Preserve relevant audit records if misuse is suspected.
What to do now
- Confirm the departure and access owner
- Revoke unneeded access through authorized channels
- Transfer record and automation ownership
- Verify revocation across connected systems
When to escalate
There is suspected unauthorized access or sensitive data exposure.
The qualified security privacy legal or control owner
Example
A former vendor user's portal access is removed and their scheduled export is reassigned.
Mistake to avoid
Deleting audit evidence while trying to remove an account quickly.
Prevent a repeat
Review access and controls when scope changes; obtain qualified advice for legal, regulatory and high-impact security decisions.
Suggested ApprovedFlow setup
- Documents
- Tasks
- Approvals
Track remediation tasks and non-sensitive review evidence; restrict sensitive incident or security detail through the authorized systems and permissions. See the platform
Related cases
- Nobody owns the periodic access review. How do I establish it?Missing access recertification ownership
- The vendor requests permanent full access for troubleshooting. Should we agree?Excessive support privileges
- New employees cannot get access without contacting the old project team. What is missing?Incomplete access-service transition
- How do we handle a team member leaving mid-project?Unplanned team transition