Mapped to NIST 800-171 Requirement: 3.9.2
CMMC Assessment Objective: PS.L2-3.9.2[c]
What This Control Means
You must be able to demonstrate that your organization is executing your offboarding and transfer procedures effectively. That includes:
• Removing system and data access promptly
• Recovering all devices and media
• Adjusting user permissions after role changes
• Ensuring these actions are logged, reviewed, and confirmed
This goes beyond intent — it’s about real, recorded action.
Why It Matters
If procedures aren’t followed:
• Former employees or vendors may retain access to CUI systems
• Staff may continue using credentials from previous roles
• Unauthorized access to sensitive systems or data may persist for months
• Audit findings may result in noncompliance penalties or contractual breach notifications
Implementation is the critical final step in personnel security.
How to Implement It
1. Execute a Standardized Process
• Use your documented checklist (from PS.L2-3.9.2[a–b]) during each termination or transfer event
• Make sure all stakeholders (HR, IT, security) complete their parts
2. Disable and Remove Access Immediately
• Systems, VPN, cloud platforms, internal drives, backup tools
• Remove from RBAC groups and access control lists
3. Recover All Assets
• Laptops, removable media, badges, authentication tokens, mobile devices
• Log returned equipment and confirm sanitization where required
4. Record and Log the Actions
• Maintain documentation of:
◦ Account disablement timestamps
◦ Who performed the actions
◦ What systems were affected
◦ What assets were returned
5. Review and Confirm
• Validate that access was removed within defined timeframes
• Include offboarding review in your quarterly access audits
Evidence the Assessor Will Look For
• Logs showing user accounts were disabled after departure
• Records of recovered hardware and data-bearing assets
• Completed offboarding checklists with timestamps
• Change tickets or audit logs from IT and access management systems
• HR documentation confirming completion of exit procedures
Common Gaps
• Offboarding steps are documented but not followed
• Account disablement delayed by days or weeks
• Shared accounts still active after a user leaves
• Asset recovery incomplete or undocumented
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Automating account disablement when offboarding is triggered
• Tracking asset return, device sanitization, and access removal steps
• Logging each offboarding task and storing completed checklists
• Ensuring offboarding is tied to user identity lifecycle management
• Supporting role change workflows that automatically adjust permissions
With Cuick Trac, termination and transfer actions aren’t just planned — they’re enforced and recorded.
Final CTA
A forgotten user is a future risk.
Schedule a Cuick Trac demo to automate, track, and prove every step of your termination and transfer procedures.