A compliance lead at a Series B healthcare startup in the East Bay pulled ten recent job leavers from the HR system for her SOC 2 auditor, and all ten came back clean. Three weeks later, while preparing for a HIPAA review, she found a contractor whose engagement had ended in the spring, but still had a working login to the reporting tool that stores patient records. The contractor had never existed in the HR system, so the auditor’s sample had never contained that name. The gap came down to employee offboarding compliance, which meant something different under each compliance framework that her company answered to.
This situation is common once startups add a second framework. Employee offboarding compliance is the set of controls and records that prove a departing person's access was removed, company assets were recovered, and continuing obligations were communicated, as required by frameworks such as SOC 2, HIPAA, and ISO 27001. None of the three frameworks sets a fixed deadline for revoking access, but each asks for timely removal and differs on scope, on who counts as a leaver, and on how you prove it.
What Employee Offboarding Compliance Requires Under All Three Frameworks
SOC 2, HIPAA, and ISO 27001 agree on four key outcomes when someone leaves: system access is removed, company devices and data are retrieved, obligations that outlast the job are communicated, and evidence recording each step is retained. Our Employee IT Lifecycle Management guide covers the day-of process of suspending accounts and wiping devices, so this post focuses on the compliance side of the same event. For the wider context of these requirements, see our guide to common IT security standards, regulations, and frameworks.
Since no framework specifies a deadline, the number an auditor holds you to is the one specified in your own policy. A company whose policy requires removal within one business day is tested against one business day, and a company with no written number leaves the interpretation to the auditor. In our experience, it’s better to establish an explicit policy limit instead of having an auditor dictate a timeline for you.
SOC 2 Offboarding Requirements: CC6.2 and CC6.3
SOC 2 is an attestation report written by an independent CPA firm against the AICPA Trust Services Criteria, two of which govern employee departures. CC6.2 requires that credentials are removed once a user's access is no longer authorized, covering both external users and internal employees. CC6.3 requires that access is modified or removed based on approved, documented requests, so role changes also fall under this control.
In a SOC 2 Type 2 examination, the auditor looks at an observation period rather than a single day. The auditor can ask for the full population of people who left during that period, select a sample, and trace each sampled person from the HR termination record to a revocation record on every in-scope system, including applications that are outside single sign-on.
The exceptions we see here most often come from the population rather than the process. In other words, those who are missing from the list. Contractors, advisors, and interns tend to live in a spreadsheet or a vendor portal, so the list the auditor receives from the HR system looks complete while a whole category of people never appears in it, as happened to the compliance lead above.
Keep the termination record and the revocation log for each leaver in one place and one format, so producing a sample takes minutes instead of a week of assembling exports. Our guide on what SOC 2 compliance involves covers the wider audit.
HIPAA Termination Procedures for ePHI Access
The HIPAA Security Rule addresses departures in 45 CFR 164.308(a)(3)(ii)(C). The specification requires procedures to terminate access to electronic protected health information (ePHI) when a workforce member’s employment ends. HIPAA is a federal regulation, not a voluntary report, and it applies directly to business associates, the category that most healthcare technology startups fall into.
The specification is labeled addressable, which does not mean optional. A covered entity or business associate must implement an addressable specification when doing so is reasonable and appropriate. Otherwise, it must document why not and adopt an equivalent alternative where one is reasonable. For something as basic as removing a leaving employee’s access to patient data, the documented-exception route is difficult to defend.
"Workforce member" is a defined term in HIPAA that encompasses employees, volunteers, trainees, and others whose conduct is under the entity's direct control, whether or not they are paid. As a result, contractors working inside your systems often count as part of your workforce.
HIPAA sets no deadline and no evidence format, but its documentation rule requires retaining required documentation for six years from the date it was created or last in effect. Written procedures, and records showing they were followed, are best kept on that schedule. Our overview of HIPAA compliance requirements covers the rest of the Security Rule.
ISO 27001 Offboarding Controls: Access Rights, Asset Return, and Duties After Exit
ISO/IEC 27001:2022 is a certification standard, and its Annex A controls are defined through a Statement of Applicability derived from your organization's risk assessment. Managing employee departures relies on three core controls: A.5.18 on access rights, A.5.11 on return of assets, and A.6.5 on responsibilities after termination or change of employment.
A.5.18 notes that access rights should be provisioned, reviewed, modified, and removed according to your own access control policy, so ISO hands the timing question back to you and then audits you against the answer. A.5.11 requires personnel and other interested parties to return the organization's assets when their employment, contract, or agreement ends, and the term covers laptops, hardware tokens, badges, and company information held anywhere else.
A.6.5 goes beyond the access cutoff and on to the obligations that outlast the job, such as confidentiality duties and similar responsibilities, which must be defined, enforced, and communicated to the person leaving. This control applies to exits as well as a change of roles. A signed exit acknowledgment reiterating those duties gives the certification auditor something concrete to inspect, though legal counsel should first review the underlying contract terms.
ISO 27001 certification involves an initial audit followed by surveillance audits. So, if your policy promises same-day removal, it must be met in every period an auditor samples. Our ISO 27001 roadmap covers the wider certification program.
Where the Three Frameworks Differ
The differences among the frameworks show up in who counts as a leaver, in how timing is worded, and in what you have to show to the auditor. The following table puts them side by side.
| Requirement | SOC 2 | HIPAA | ISO 27001:2022 |
|---|---|---|---|
| Nature | Voluntary attestation report | Federal regulation | Voluntary certification |
| Source | CC6.2 and CC6.3 | 45 CFR 164.308(a)(3)(ii)(C) | Annex A 5.18, 5.11, and 6.5 |
| Who counts | Internal and external users | Workforce members | Personnel and other interested parties |
| Timing language | Removed when access is no longer authorized | When employment ends | Per your own access control policy |
| What the auditor or reviewer looks for | Full leaver population, then a sample traced across every in-scope system | Documented procedures and proof they were followed, retained six years | Revocation records, asset return, and communicated post-exit duties |
What causes the most issues here is the definition of “leaver”, i.e., who counts. HIPAA's workforce members, SOC 2's external users, and ISO's interested parties all reach past the payroll list. This makes a leaver population built from the HR system alone incomplete under every one of them.
Building One Offboarding Process That Satisfies All Three
A single process can serve all three frameworks if built to the strictest version of each dimension. The population is, therefore, every person with access, whether employee, contractor, vendor, advisor, or intern, and the scope is every system holding sensitive data, with or without single sign-on.
In our employee lifecycle management guide, we recommend suspending the identity provider account within the hour and closing everything else the same business day. That standard is easy to defend under all three frameworks, provided you write it into policy and meet it consistently. It is far better to maintain a modest same-day standard with flawless evidence than to set an ambitious fifteen-minute target that is only met nine times out of ten, as an auditor will invariably focus on the tenth departure.
The population comes next. Build the leaver list from every source of identity you have: for example, the HR system, the contractor and vendor list, and the identity provider's record of active accounts. Reconcile the lists monthly, so anyone who left without an HR record still surfaces.
Evidence follows from the same record. For each leaver, keep the notice date and time, each revocation with its timestamp, the asset return, the exit acknowledgment, and the name of whoever approved the closure. Store everything in one place and retain it for six years where HIPAA applies, and the same file will answer the SOC 2 sample, the HIPAA review, and the ISO surveillance audit.
Nothing shared in this blog replaces legal advice, so confirm retention periods and exit acknowledgment clauses that depend on your contracts or jurisdiction with your legal counsel.
Employee Offboarding Compliance Checklist
Confirm each of the following before your next audit:
A written revocation standard exists with a number your team meets every time; for example, the identity provider within the hour and everything else the same business day.
The leaver population is drawn from the HR system, the contractor and vendor list, and the identity provider, and is reconciled monthly.
Applications outside single sign-on appear in the same revocation log as everything else.
Each leaver has a record with the notice time, timestamped revocations, and the approver.
Company assets, such as hardware tokens and badges, are recovered and logged.
Exit acknowledgment reiterates continuing confidentiality duties, with the clauses reviewed by counsel.
Role changes trigger the same access review as exits.
Records are retained for six years where HIPAA applies, and for the period your auditor and customer contracts require elsewhere.
Closing the Gap Once for Every Framework
The compliance lead from the opening rebuilt her leaver list from three sources, wrote a same-day standard into policy, and now produces one file per departure that answers both her SOC 2 auditor and her HIPAA review. The rebuild took a matter of weeks, and each subsequent request for leaver evidence was answered from the same file.
Gaps like these usually come to light only when an auditor or reviewer poses a question the current process fails to answer. Reviewing both the complete leaver population and the corresponding evidence trail in advance makes any process rebuild smoother. If your team is managing multiple compliance frameworks and could benefit from an extra perspective, we would be glad to help evaluate your existing offboarding workflows.
Employee Offboarding Compliance FAQ
Is there a legal deadline for revoking access when an employee leaves?
SOC 2, HIPAA, and ISO 27001 do not specify a fixed number of hours for revoking access. Typically, your customer contracts and security questionnaires determine this deadline. Check the security addendum in your largest customer agreements, and ask your legal counsel whether any other legal deadline applies to your situation.
Does HIPAA require same-day access removal?
HIPAA's termination procedures specification does not specify a timeframe and is addressable. The specification ties access termination to the end of employment, so same-day removal is the standard that most compliance teams adopt; therefore, the easiest to defend.
Do contractors and vendors count as leavers?
Yes. SOC 2 CC6.2 covers external users, while HIPAA covers workforce members, which can include non-employees under the entity's direct control. ISO 27001 A.5.11 covers personnel and other interested parties. A leaver process driven only by the HR system leaves gaps under all three.
How long should offboarding records be kept?
Where HIPAA applies, you are required to keep records for six years from the date a required record was created or last in effect. Elsewhere, keep records at least through your SOC 2 observation periods and ISO surveillance cycles. It’s good practice to confirm the specific period with your auditor.
Master employee offboarding compliance for SOC 2, HIPAA, and ISO 27001. Learn key requirements, framework differences, and how to build a unified process.