ISO 27001 A.6.5: Manage Security Duties After Role Changes

What A.6.5 requires in practice

Annex A control 6.5 recognises that some security duties do not end when a person leaves or moves to a different role. The control asks the organisation to define which responsibilities remain valid after termination or a change of employment, to enforce them, and to communicate them to the people and other parties concerned. Three questions follow from it. What stops, because the person no longer does the work? What continues, such as confidentiality obligations that remain binding? What moves to someone else, such as approval duties tied to the role? The control reaches beyond returning equipment and closing accounts, which are covered elsewhere. The expected outputs are a defined view of continuing duties, a transition step where they are explained, and a named new owner for responsibilities that belong to the role. The length of any continuing obligation depends on applicable law and agreements, not on the standard.

Identify what ends, what continues and what transfers

List the information-security responsibilities associated with the departing or changing role. Some cease because the person no longer performs the work. Others, such as applicable confidentiality obligations, may continue. Responsibilities owned by the role, such as approving access or reviewing a supplier, need a new accountable owner.

Make this distinction before the transition where possible. A generic exit checklist can confirm administration while missing an important control that only the departing person performed. Ask the manager which decisions, contacts and recurring tasks would otherwise become ownerless.

Treat a role change as ending the old responsibility and beginning the new one. Someone remaining in the organisation does not automatically retain every former permission or need to know. At the same time, the new role may introduce duties that require fresh communication and learning.

Communicate continuing obligations clearly

Use the applicable employment or contractual arrangements to identify continuing duties. At transition, explain the responsibilities relevant to the person, including how information should be handled and whom to contact if a later question or accidental possession of material arises.

A reminder should reflect existing applicable obligations rather than introduce an improvised restriction at the last moment. Obtain appropriate HR and legal input where needed. The objective is clear, lawful and usable expectations, not a claim that every restriction is enforceable merely because it appears on an exit form.

Why managing duties after role changes matters to the business

People take knowledge with them, and the moment of departure or transfer is when responsibilities are most likely to fall through a gap. A control owner who leaves without handover can leave a supplier review, an access approval or a recurring check with nobody accountable. A person who changes role may keep permissions and information they no longer need. Customers expect that former staff remain bound by confidentiality, and that expectation is only credible if the obligation was explained clearly. Handling transitions well reduces the chance of data exposure, avoids silent lapses in controls and gives auditors visible evidence that leaver and mover processes are working.

How to implement A.6.5

Treat leavers and movers as two related situations, each with its own questions.

1. Review your exit and transfer process and confirm it addresses duties, not only property and accounts.
2. For each role, identify responsibilities that would become ownerless if the person left, and record who takes them over.
3. Work with HR and legal to confirm which obligations continue under the person's agreement, and how they are described.
4. Add a conversation at departure or transfer in which the manager explains continuing duties and gives a contact for later questions.
5. For movers, state clearly which duties and permissions of the old role end and which new ones begin.
6. Link the process to access removal and asset return so that the three activities are completed together.
7. Check a sample of recent leavers and movers to confirm that the steps happened and adjust the process where they did not. Include someone who moved internally, since those cases are easiest to miss.

Illustrative software example: the control owner leaves

Illustrative construction example: a project transfer within the company

A hypothetical construction employee moves from a confidential tender team to an active project role. Because employment continues, the organisation performs no transition review. The employee remains a contact for the tender portal and receives information unrelated to the new assignment.

The manager closes the old responsibilities, updates communications and access, and establishes the new role’s duties. Relevant confidentiality obligations concerning the tender remain clear. The example shows why internal moves require attention even though they do not look like conventional employee departures.

Include supplier and temporary personnel

External personnel can leave an assignment while their employer remains a supplier. Establish how the organisation learns of the change, communicates relevant duties and transfers responsibilities. A supplier’s internal departure process may not automatically update your project contacts or customer permissions.

Clarify the respective responsibilities through the agreed relationship. The organisation may need confirmation of transition actions without receiving unnecessary personal details. Maintain a usable route for unresolved handover issues and avoid relying solely on the individual’s informal promise to help later.

Preserve business knowledge without leaving unnecessary access

Plan authorised handover of information, decisions and operating knowledge. Last-minute pressure to preserve work can lead teams to leave accounts active indefinitely or share credentials. A controlled handover should establish continued business access through appropriate ownership and permissions.

Do not confuse continuing confidentiality with continuing authority. A former employee may remain bound by an obligation yet have no right to access systems or act for the organisation. Update internal and relevant external contacts so that others do not continue requesting approvals from an obsolete role.

Evidence and practical checks

Common nonconformities with A.6.5

Findings often reveal that offboarding is treated as an administrative task. These usually show up when an auditor follows one real leaver or mover from request to completion.

• Exit checklists that cover equipment and accounts but not continuing confidentiality or ownership of duties.
• Staff who changed department retaining access and duties from the previous role.
• Reminders of continuing obligations that are improvised and inconsistent between managers.
• No record that the person was told what continues after they leave.
• A departing manager whose recurring review duties were never reassigned and quietly stopped happening.