Onboarding and Termination Policy

The Onboarding and Termination Policy (document P07) provides a comprehensive, standardized framework for managing the full lifecycle of personnel access, from onboarding and internal transfers to termination or contract expiry. Designed for all user types, including employees, contractors, consultants, vendors, and third parties, it enforces timely and secure provisioning and deprovisioning of both physical and logical access, ensuring that every transition is handled with the right blend of confidentiality, accountability, and asset control. This policy applies organization-wide, mandating that all departments, Human Resources, IT, Facilities, Security, Management, Legal, and Compliance, play a defined role in onboarding and offboarding processes. It prescribes detailed workflows: onboarding includes background checks, NDA and policy acknowledgment, security awareness training, and least-privilege access assignment reviewed by responsible managers; for internal transfers, it triggers risk-based access reviews and ensures all prior system entitlements are closed before new access is approved; and the termination process requires all access provision to be revoked (privileged users within four hours), assets collected, policies re-acknowledged, and all related documentation maintained for auditability. The policy’s objectives extend beyond access management. It aims to preserve the confidentiality, integrity, and availability of organizational assets during personnel transitions, supporting audit trails and legal defensibility by requiring thorough documentation in HRIS, IAM, and asset registers. Immediate asset recovery and validation procedures are specified, including IT checks to remove residual sensitive data and facility controls for badges, devices, and keys. Exception handling is tightly controlled: any deviations must be risk-assessed, documented, and subject to periodic reviews by senior managers (CISO or HR Director), with residual risks documented and evaluated every 90 days or as situations change. Aligned with multiple international frameworks, including ISO/IEC 27001:2022, ISO/IEC 27002:2022, NIST SP 800-53 Rev.5, COBIT 2019, EU GDPR, NIS2, and DORA, the policy ensures that organizational practices address all key regulatory requirements. It integrates provisions from these standards covering competence, access control, least privilege, screening, logging, and operational governance. Internal audit and process monitoring requirements are built-in, with ISMS Manager oversight and mechanisms for whistleblower reporting. Violations trigger disciplinary and legal consequences, with escalation to regulatory authorities where personal or regulated data are involved. Policy maintenance is equally robust: it mandates annual reviews, updates after major security or HR system changes, incident-driven updates, and archiving of obsolete versions. Document control procedures preserve change history and ownership records. This interlinks operational risk management with compliance and accountability, forming a critical part of the organization’s integrated control environment through direct linkages to related policy documents (security, access control, user accounts, risk management, acceptable use).