Procedure
IT Onboarding and Offboarding Procedure
This procedure governs the provisioning and deprovisioning of system access and IT assets across the full personnel lifecycle: pre-joining, first-day onboarding, role transfers and changes, voluntary departure, and involuntary termination. It ensures that access rights are granted on a least-privilege basis, are aligned to approved role profiles, and are removed promptly and completely when no longer required.
- Type
- Procedure
- Version
- 1.3.1
- Date
- 2026-10-24
- Owner
- Chief Information Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance and accountability
- 4. Pre-joining and hire notification
- 5. First-day provisioning
- 6. Role changes and transfers
- 7. Voluntary departure
- 8. Involuntary departure
- 9. Contractor and third-party offboarding
- 10. Privileged access deprovisioning
- 11. Deprovisioning checklist
- 12. Evidence and records retention
- 13. Framework alignment
Frameworks it maps to
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- NIST SP 800-53 Rev. 5
- CIS Controls v8.1
- US DoD CMMC Assessment Guide Level 2 v2.13
- VDA ISA 6.0.3 (TISAX, automotive sector)
- UK NCSC Cyber Essentials v3.3
- Canada CCCS Baseline Cyber Security Controls for Small and Medium Organizations V1.2
- Council of Europe Recommendation CM/Rec(2015)5 (processing of personal data in the context of employment)
Related documents
- Information Security Policysecurity
- Bring Your Own Device (BYOD) Policysecurity
- Acceptable Use Policysecurity
- Privileged Access Management Standardsecurity
- Endpoint Management and Device Compliance Procedureoperations
- Corrective and Preventive Action (CAPA) Procedurecompliance
Next
All Documents