Mapped to NIST 800-171 Requirement: 3.9.2
CMMC Assessment Objective: PS.L2-3.9.2[a]
What This Control Means
Your organization must have a defined process that outlines:
• What to do when an employee or contractor leaves the organization (voluntarily or involuntarily)
• What steps to take when someone transfers to a new role, especially if it reduces or removes their need for access to CUI
The process should focus on disabling accounts, revoking access, recovering devices, and protecting CUI.
Why It Matters
Failure to take swift and defined action when someone leaves or changes roles can result in:
• Continued access to systems containing CUI
• Former employees or contractors retaining login credentials
• Forgotten accounts becoming entry points for attackers
• Insider threats persisting even after a departure
This control protects your systems and data from lingering access vulnerabilities.
How to Implement It
1. Define Termination Actions
• Disable or delete user accounts
• Revoke VPN or system-level access
• Recover all hardware and removable media
• Reclaim access cards or credentials
2. Define Transfer Actions
• Reevaluate access based on the new role
• Remove permissions no longer needed
• Reissue devices or update configurations if needed
3. Document in Policy or SOP
• Include a personnel exit checklist
• Assign responsibility to HR, IT, and management
4. Link to Asset and Access Management
• Cross-check return of CUI-handling devices
• Track access to cloud systems, backup portals, and encrypted data
5. Apply to All Users
• Full-time staff, contractors, MSPs, remote users, and interns
Evidence the Assessor Will Look For
• Termination or role change procedures with step-by-step actions
• Policy language addressing user deprovisioning and access review
• Account disablement logs
• Equipment return checklists
• Coordination procedures between HR, IT, and security
Common Gaps
• No formal process—reliant on manual reminders or ad hoc steps
• System access left active for days or weeks after someone leaves
• Cloud access or admin rights not included in termination workflows
• Devices not recovered or remotely wiped
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Providing termination and role-change workflows with task checklists
• Automating access reviews and deprovisioning tied to HR updates
• Tracking device return and revocation of credentials
• Logging access removal events across the enclave
• Storing signed termination acknowledgments or NDA enforcement steps
With Cuick Trac, offboarding isn’t forgotten—it’s formalized and enforced.
Final CTA
When people leave, their access should too.
Schedule a Cuick Trac demo to automate and document secure termination and transfer procedures.