ISO 27001:2022 · People controls
ISO 27001:2022 6.5: Responsibilities after termination or change of employment
ISO 27001:2022 6.5 covers Responsibilities after termination or change of employment. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.6.5, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Leavers are not reminded of continuing confidentiality obligations.
Where information security responsibilities and duties continue after someone leaves or changes job, they are to be defined and enforced, and the people and outside parties concerned are to be told about them. Purpose (stated in ISO/IEC 27002:2022): protects the organization's interests when employment or contracts change or end. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 6.5.
What evidence supports 6.5?
- Annex A people controlStatement of Applicability entry for control A.6.5, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A people controlLeaver and mover procedures stating which security responsibilities survive termination or change
- Annex A people controlTerms and conditions or agreements containing the continuing obligations and their duration
- Annex A people controlRecords of security roles reassigned when their holders left or changed jobs
- Annex A people controlExit communications reminding leavers of continuing confidentiality and intellectual property duties
Where this requirement comes from
This is our own statement of ISO 27001:2022 6.5, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Leavers are not reminded of continuing confidentiality obligations
- Security roles such as system owner or key custodian are left vacant after someone leaves
- Internal moves are not treated as leave-and-join, so old access and duties persist
- External contacts keep dealing with people who no longer hold the role
How it maps to SOC 2
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.