customer asks how we revoke access from employees who have left

Revoking access upon termination of employment

This question tests whether the offboarding process is watertight: does the access of a departing employee really close, and does it happen quickly enough? The client does not want a description of the procedure on paper, but evidence that it actually works — that no accounts remain "hanging" after departure. This falls under access control and asset management, specifically the section covering the termination of access rights.

Concrete evidence for this is an offboarding checklist or procedure that specifies which systems are shut down: email, VPN, shared drives, SaaS applications, building access and any API keys or service logins that were registered under that employee's name. Stronger evidence is a log or ticket overview showing that this also happens within an established timeframe, for example the same day or within 24 hours. If there are periodic account reviews — a quarterly check that identifies orphaned accounts — that is a good addition, and that review is also part of the periodic testing of security measures. If a formal procedure is missing, then "no" is the honest answer; a promise that it "usually happens" is not a substantiated answer.

Where this falls under: Article 21(2) and Annex A

Access control is named in Article 21(2) of the NIS2 Directive as one of the ten mandatory measures, and that is precisely the category under which this question falls — not separately designated as "offboarding", but as part of access control in the broader sense. In ISO/IEC 27001 this is reflected more specifically in the control measures of Annex A, where revoking access rights upon termination of employment is its own control, separate from general access provisioning. For entities that will fall under the Cybersecurity Act once it enters into force, the same classification applies as in the Directive.