Reach SOC 2 Compliance in 6 Weeks or Less.

/ SOC 2 Compliance Checklist: A Step-by-Step Guide

SOC 2 Compliance Checklist: A Step-by-Step Guide

Pedro Dias
February 13, 2026

SOC 2 compliance can sometimes feel like a needlessly complex Pandora’s box of documentation. But it shouldn’t be. That’s why today, we’ll show you how to easily become compliant with our 12-step SOC 2 compliance checklist.
In its simplest form, all the SOC 2 sections point to the same question:

Can you prove your controls work?

This SOC 2 Compliance Checklist guides you through the process from scoping through audit completion for both SOC 2 Type 1 and Type 2. It is practical, auditor-aligned, and written for teams that want clarity rather than theory.

If you want the short version: SOC 2 is not about tools or paperwork. It is about repeatable processes, clear ownership, and evidence that stands up to scrutiny.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

What is a SOC 2 compliance checklist?

A SOC 2 compliance checklist is a structured roadmap that maps your internal controls to the AICPA Trust Services Criteria and prepares your organization for a Type 1 or Type 2 audit.

For a full breakdown of SOC 2 requirements, read our detailed SOC 2 guide.

How to Use This SOC 2 Compliance Checklist

Think of this checklist as a living roadmap, not a one-time document. You should revisit it at four points: before scoping, during readiness, throughout evidence collection, and after the audit for continuous compliance.

Type 1 vs. Type 2: Which Checklist Items Change?

The core checklist does not change dramatically between Type 1 and Type 2. What changes is time and proof.

Type 1 evaluates whether controls are designed correctly at a specific point in time. Type 2 evaluates whether those same controls operated effectively over an observation period, usually 3, 6, or 12 months.

This means evidence for Type 2 must show consistency, such as quarterly access reviews, repeated vulnerability scans, and incident response tests that actually occurred.

Who Owns Each Workstream

SOC 2 is cross-functional by design. Security may lead, but it cannot succeed alone.

Engineering typically owns secure SDLC, change management, and logging. IT owns IAM, endpoints, and device management. Legal and HR contribute policies, onboarding controls, and training. GRC or compliance coordinates risk assessment, evidence, and auditor communication.

The fastest SOC 2 projects have named control owners with deadlines, not shared responsibility.

What “Audit-Ready” Really Means

Being audit-ready does not mean “we think we are secure.” It means you can produce clear, dated, and traceable evidence that maps directly to the Trust Services Criteria.

Auditors test design, then operation. They expect policies, tickets, screenshots, logs, and approvals. They also expect alignment. If your policy says quarterly, your evidence cannot show annual.

The AICPA provides the underlying standard, supported by SSAE 18 and AT-C 205.

Pre-Checklist: Confirm You Actually Need SOC 2

Not every company needs SOC 2 immediately. If your customers are SMBs, you may see lighter requirements. If you sell to enterprises, SOC 2 often becomes non-negotiable.

Security questionnaires are the strongest signal. When prospects ask about penetration testing, access reviews, and incident response evidence, SOC 2 is usually the cleanest way to respond at scale.

Alternatives like ISO 27001, PCI DSS, or HIPAA can be valid. But SOC 2 is uniquely customer-facing, especially in North America. ISO 27001 is excellent for global alignment, while SOC 2 maps directly to buyer trust.

The 12-Step Checklist

Step 1- Define Scope

Scoping mistakes cause more SOC 2 delays than any missing control.

Your scope must clearly define the services you provide, the systems that support them, and the access controls. Over-scoping increases cost and complexity. Under-scoping leads to auditor pushback.

In-scope systems usually include production cloud environments, CI/CD pipelines, support tooling, and identity providers. In-scope people include employees and contractors with access to customer data. Third parties are addressed as Subservice organization, using either the Carve-out method or Inclusive method.

Data classification and flows must identify PII, PHI, or payment data, and how it moves through systems.

Action Plan for Scoping

Define the Service Commitment
List In-Scope Systems
Identify In-Scope People
Document Third Parties
Map Data Flows
Validate Scope with Leadership

Step 2- Select the Trust Services Criteria

All SOC 2 reports include Security (Common Criteria). The others are optional but must be justified.

Availability focuses on uptime and disaster recovery. Confidentiality focuses on sensitive data protection. Processing Integrity focuses on system accuracy. Privacy applies when personal data obligations are central.

Your report must document why each criterion is included or excluded. Auditors look closely at this rationale.

Trust Service Criteria Action Plan

Confirm Security (Mandatory)
Assess Optional Criteria
Document Inclusion Rationale
Obtain Executive Sign-Off

Step 3- Choose the Audit Path and Timeline

Most teams benefit from a readiness assessment before audit. This is often referred to as a Readiness assessment or Gap analysis.

Type 1 audits can be completed in weeks once controls are ready. Type 2 timelines depend on the observation period. Six months is the most common balance between speed and credibility.

Define control owners early and create an evidence calendar. Late evidence is the enemy of clean audits.

Audit Path and Timeline Action Plan

Conduct Readiness or Gap Assessment
Choose Audit Type
Set Observation Period (Type 2)
Assign Control Owners
Build Evidence Calendar

Step 4- Pick an Auditor and Define the Engagement

Choose a CPA firm with real SOC 2 experience in your industry. Responsiveness matters more than brand name.

Confirm standards, testing approach, sampling expectations, and how subservice organizations are treated. The engagement letter should clearly state scope, period, and deliverables. A clear PBC list process avoids confusion later.

Action plan for finding an auditor.

Shortlist CPA Firms
Review Testing Approach
Clarify Subservice Treatment
Finalize Engagement Letter
Request Preliminary PBC List

Step 5- Perform a SOC 2 Gap Analysis

Map existing controls to the Trust Services Criteria. Missing policies, undocumented processes, and inconsistent evidence usually surface here.

Prioritize high-risk gaps first. Document known exceptions and compensating controls honestly. Auditors prefer transparency over perfection.

Gap Analysis Action Plan:

Map Controls to Criteria
Identify Missing Controls
Prioritize by Risk
Document Compensating Controls

Step 6- Build the Policy and Governance Foundation

Policies should reflect reality. Information security, access control, change management, incident response, vendor risk management, and BCDR must all exist, be approved, and be followed.

If Privacy is in scope, privacy notices, data handling, and retention policies must align with actual practices.

Governance Action Plan

Draft Core Policies
Align Policy to Reality
Obtain Formal Approval
Train Staff

Step 7- Implement Security (Common Criteria) Controls

This is where most effort goes. IAM, MFA, SSO, and RBAC must be enforced, not optional. Logging, monitoring, vulnerability scanning, and patch management must be operational.

Auditors expect encryption in transit and at rest, typically supported by KMS. Secure SDLC, change management, incident response, risk assessment, vendor reviews, and physical security all fall under this umbrella.

Common Control Implementation Action Plan

Enforce Identity Controls
Enable Monitoring
Implement Vulnerability Management
Encrypt Data
Operationalize Secure SDLC
Run Risk Assessment

Step 8- Availability, Confidentiality, Processing Integrity, Privacy

Only implement what is in scope. Availability requires uptime definitions, monitoring, and tested disaster recovery. Confidentiality focuses on data handling and disposal. Processing Integrity requires evidence that systems do what you promise customers. Privacy requires DSAR handling, consent, and cross-border controls.

Availability

Define uptime commitments.
Document monitoring thresholds.
Test BCDR annually.
Record test results and improvements.

Confidentiality

Classify confidential data.
Restrict access via RBAC.
Define disposal procedures.
Validate encryption controls.

Processing Integrity

Document system processing controls.
Define input validation mechanisms.
Monitor output accuracy.
Track customer issue resolution.

Privacy

Publish privacy notice aligned with practice.
Implement DSAR handling process.
Define data retention schedule.
Control cross-border transfers.

Step 9- Build the Evidence Package

Auditors test evidence, not intent. They expect a clear System description, control narratives, access reviews, change tickets, incident records, vulnerability scans, vendor SOC reports, training logs, and BCDR test results.

Evidence must be complete, dated, and traceable.

Evidence Package Action Plan

Draft System Description
Collect Control Evidence
Ensure Traceability

Step 10 — Run Internal Reviews

Before the auditor looks, you should. Control owners should sign off. Exceptions should be documented with root cause and corrective action. Management review is not optional.

Internal Review Action Plan

Control Owner Sign-Off
Document Exceptions
Management Review

Step 11 — Complete the Audit

Expect walkthroughs, sampling, and follow-up questions. Review the draft report carefully, especially scope language and subservice organization descriptions.

Audit Action Plan

Prepare for Walkthroughs
Respond to Sampling Requests Quickly
Review Draft Report Carefully

Step 12 — Maintain Continuous SOC 2 Compliance

SOC 2 is not annual busywork. Continuous monitoring, periodic access reviews, quarterly vulnerability scans, annual risk assessments, and vendor re-reviews keep you audit-ready.

Teams that treat SOC 2 as a one-time project struggle with every renewal.

Maintaining Compliance Action Plan

Schedule Recurring Reviews
Monitor Vendor Changes
Automate Evidence Collection
Track Metrics
Embed Compliance into Operations

Ready to Use This Checklist in Practice?

If you want to turn this SOC 2 compliance checklist into a clear plan with owners, timelines, and auditor-ready evidence, Axipro can help.

Our Achievement Plan guides teams from scope to SOC 2 readiness in as little as six weeks, combining human expertise with the right automation tools. Whether you need a readiness assessment, a full Type 1 or Type 2 audit, or help maintaining compliance, we simplify the process so your team can focus on growth.

Book a SOC 2 readiness call or request a checklist walkthrough today, and move from “working on compliance” to confidently audit-ready.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

Is this SOC 2 compliance checklist enough to pass an audit?

The checklist is designed to align with the AICPA Trust Services Criteria and reflects what auditors test in both Type 1 and Type 2 engagements. However, a checklist alone does not guarantee a clean report. Success depends on Accurate scoping, Clear control ownership, Proper documentation, Consistent evidence over time, and Management oversight. The checklist provides structure. Execution determines the outcome.

How should we use this checklist internally?

This checklist should function as a project management framework rather than a static document. Organizations should assign ownership for each step, define deadlines, and maintain an evidence tracker alongside the checklist. During readiness, it should be reviewed regularly to monitor progress and identify blockers. After certification, it should evolve into a quarterly governance tool to maintain continuous compliance rather than being archived as a completed project.

What is the most commonly overlooked step in the checklist?

Scoping is the most frequently underestimated step. Poor scope definition can result in expanded audit testing, increased costs, and delays due to auditor pushback. Another commonly overlooked area is evidence preparation. Many organizations implement controls but fail to collect clear, dated, and traceable documentation. Even well-designed controls can create audit friction if evidence is incomplete or inconsistent.

Can we exclude optional Trust Services Criteria to simplify the checklist?

Yes, but exclusions must be intentional and justified. Security, also known as the Common Criteria, is mandatory in every SOC 2 report. The inclusion of Availability, Confidentiality, Processing Integrity, or Privacy depends on customer commitments, regulatory requirements, contractual obligations, and data sensitivity. Auditors expect a documented rationale explaining why each optional criterion was included or excluded. Simply omitting criteria without explanation can raise concerns during review.

Who should own the checklist within the organization?

SOC 2 is inherently cross-functional. While security or GRC teams often coordinate the effort, engineering, IT, HR, legal, and executive leadership all play essential roles. The checklist works most effectively when each control area has a clearly defined owner with accountability for implementation, documentation, and ongoing monitoring. Shared responsibility without defined ownership frequently leads to gaps and delays.

How do we know when we are truly audit-ready?

You are audit-ready when every control has a designated owner, policies are formally approved and consistently followed, evidence is complete and traceable, and your system description accurately reflects your environment. Management should have reviewed and signed off on the program before the auditor begins testing. If your team can confidently walk an auditor through each checklist step with supporting documentation, you are prepared for a structured and efficient audit experience.

Axipro Author

Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

February 13, 2026
All Blog, SOC-2

Blog Highlights

Explore More Articles

SOC-2

June 1, 2026

How to Build an Incident Reporting Process That Holds Up in a SOC 2 Audit

A SOC 2 auditor will not ask whether you have an incident reporting policy. They will ask you to pull a specific incident from the last twelve months and walk them through it: when it was detected, who classified it, when it was escalated, who was notified, and how it was closed. The policy is the easy part. The part that fails audits is the gap between what the document says and what the timestamps actually show. Incident reporting sits at the center of the SOC 2 System Operations criteria, and it is one of the most frequently exception-flagged areas in Type 2 reports. The reason is consistent: teams treat reporting as paperwork generated after the fire is out, rather than as a controlled process that produces evidence at every step. This guide breaks down how to build a reporting process that an auditor can test, sample, and sign off on without a finding. What Is the Incident Reporting Process in SOC 2? The incident reporting process is the documented, repeatable sequence your organization follows from the moment a security event is detected to the moment the incident is formally closed and archived. It governs how events are logged, classified, escalated, communicated, and recorded. Reporting is not a single notification email. It is the connective tissue that links detection, response, and post-incident review into an auditable chain. How SOC 2 Defines a Security Incident SOC 2 does not hand you a rigid statutory definition. It works through the AICPA’s Trust Services Criteria, which frame an incident around a failure, or potential failure, of the system to meet the organization’s service commitments and security objectives. In practice, a security incident is any event that compromises, or could compromise, the confidentiality, integrity, or availability of systems or data. The criteria expect you to define this threshold yourself and apply it consistently, which is precisely what auditors test against. What Qualifies as a Reportable Security Incident Under SOC 2? An event becomes reportable when it crosses the threshold your own policy sets. The distinction matters. A blocked phishing email is a security event. A user who clicked the link and entered credentials is a reportable incident. SOC 2 rewards organizations that draw this line explicitly, because a clear definition is what makes consistent triage possible. Vague language like “significant events will be reported” invites the auditor to ask who decides what counts as significant, and on what basis. Examples of Security Incidents Relevant to SOC 2 Common reportable incidents include unauthorized access to production systems, credential compromise, malware or ransomware infection, data exfiltration or accidental disclosure, denial-of-service events affecting availability, lost or stolen devices holding company data, and misconfigurations that expose data to the public. Vendor and subprocessor breaches that touch your data belong on this list, too, since the criteria extend your responsibility into the supply chain. How Incident Severity Levels Are Established and Classified Severity classification drives everything downstream: how fast you respond, who gets pulled in, and which notification clocks start ticking. Most mature programs use a tiered scheme tied to business impact rather than technical noise. The point is not the labels you choose but the fact that the labels map to defined response times and escalation paths, and that the mapping is documented before an incident occurs, not invented during one. Auditors quietly judge your maturity by how few P1s you declare and how consistently you apply the tiers. A program that labels everything critical looks panicked; one that never escalates looks asleep. The strongest signal is a severity matrix with response-time SLAs next to each tier, and ticket history showing the tiers were actually applied as written. SOC 2 Incident Reporting Requirements There is no single “incident reporting requirement” in SOC 2. The obligation is distributed across several Common Criteria, and the auditor assembles a picture from all of them. Understanding which criteria govern reporting tells you exactly what evidence to keep. Which SOC 2 Trust Services Criteria Govern Incident Reporting? Incident reporting lives mainly in the CC7 (System Operations) series. CC7.2 covers monitoring system components to detect anomalies that may signal an incident. CC7.3 requires you to evaluate detected events to determine whether they are incidents and to take action. CC7.4 governs the response itself, including containment, eradication, and communication. CC7.5 addresses recovery and remediation. Communication obligations also reach into CC2.2 and CC2.3, which deal with internal and external information flow, and third-party incidents implicate CC9.2 on vendor risk. These are points of focus, not a checklist, but auditors use them to frame their testing. For a deeper look at how these criteria map to your broader compliance program, see our SOC 2 compliance guide. What Evidence Do Auditors Expect From Your Incident Reporting Process? Auditors want artifacts with time references, not assertions. That means incident tickets showing detection and closure timestamps, severity classifications with the name of who assigned them, escalation records, communication logs, and post-incident review notes. In a Type 2 examination they will trace one real incident end to end. Evidence pulled from a staging environment, or any artifact with no clear date, gets challenged immediately. Who Is Responsible for Reporting Security Incidents? Everyone reports; a defined role decides. SOC 2 expects that all staff know how to raise a suspected incident, and that a named function, often a security lead or incident commander, owns the determination of severity and the decision to escalate. The auditor will look for evidence that this ownership is real: a RACI chart is fine, but ticket history showing the right person actually classified and closed incidents is better. Step-by-Step SOC 2 Incident Reporting Process The following sequence maps cleanly to the lifecycle in NIST’s Computer Security Incident Handling Guide (SP 800-61), which auditors widely recognize as authoritative. NIST withdrew Revision 2 in April 2025 and released Revision 3, which reorganizes the lifecycle around the six functions of the Cybersecurity Framework 2.0. The underlying steps below remain the same; the framing simply shifts toward continuous risk management.

GDPR, HIPAA

May 29, 2026

HIPAA vs GDPR: Key Differences & Dual Compliance Guide

HIPAA and GDPR are the two most consequential data protection frameworks any healthcare or technology organisation is likely to encounter. They share a common purpose, protecting sensitive personal data, but they differ significantly in scope, enforcement mechanisms, and compliance obligations. For organisations operating across the Atlantic, understanding where they align, where they clash, and how to satisfy both simultaneously is not optional. It is a legal necessity. What Is HIPAA? The Health Insurance Portability and Accountability Act was enacted by the U.S. Congress in 1996. Its original purpose was to modernise the flow of healthcare information and ensure the portability of health insurance coverage. Over time, it became primarily known for its data protection requirements, administered by the U.S. Department of Health and Human Services (HHS) and enforced by the Office for Civil Rights (OCR). HIPAA is built around three core rules. The Privacy Rule governs how Protected Health Information (PHI) may be used and disclosed. The Security Rule sets standards for safeguarding electronic PHI (ePHI). The Breach Notification Rule establishes mandatory reporting timelines when PHI is compromised. Who Needs to Be HIPAA Compliant? HIPAA applies to covered entities, healthcare providers, health plans, and healthcare clearinghouses, and to their business associates: any third-party organisation that handles PHI on their behalf. If you build software that processes patient data for a U.S. hospital, you are a business associate. If you store medical records in the cloud for an insurance company, you are a business associate. A Business Associate Agreement (BAA) is the formal contract that governs this relationship. What Types of Data Does HIPAA Protect? HIPAA protects Protected Health Information (PHI): any individually identifiable information relating to a person’s past, present, or future physical or mental health condition, the provision of healthcare, or the payment for healthcare. This includes names, dates of birth, Social Security numbers, medical record numbers, and any data that could be used to identify a patient in connection with their health. Electronic PHI, the subset stored or transmitted digitally, is subject to the Security Rule’s additional technical requirements. What Is GDPR? The General Data Protection Regulation came into force across the European Union on 25 May 2018, replacing the 1995 Data Protection Directive. It is the world’s most comprehensive data privacy law, and its extraterritorial reach means it extends well beyond Europe’s borders. The GDPR is enforced by national Data Protection Authorities (DPAs) and coordinated at the European level by the European Data Protection Board (EDPB). Unlike HIPAA, GDPR is not sector-specific. It applies to any organisation processing the personal data of EU residents, regardless of industry. Who Needs to Be GDPR Compliant? Any organisation that processes the personal data of individuals located in the European Union, regardless of where the organisation is based. A U.S. hospital treating European patients, a SaaS company offering services to German users, or a health app collecting data from French residents all fall within GDPR’s scope. The regulation applies to both data controllers (organisations that determine how and why data is processed) and data processors (third parties that process data on a controller’s behalf). What Types of Data Does GDPR Protect? GDPR protects all personal data: any information relating to an identified or identifiable natural person. Health data is explicitly designated a special category under GDPR Article 9, commanding heightened protection alongside biometric data, genetic data, racial or ethnic origin, religious beliefs, and sexual orientation. HIPAA vs GDPR: Key Differences at a Glance Feature HIPAA GDPR Jurisdiction United States only EU + extraterritorial reach Sector Healthcare only All sectors Regulatory body HHS / OCR National DPAs / EDPB Data covered PHI only All personal data Consent model Treatment-based exceptions Explicit consent required Breach notification 60 days (proposed: 72 hours) 72 hours Max fine $1.9M per violation category/year €20M or 4% of global turnover DPO required No Sometimes Right to erasure Limited Yes Scope and Geographic Reach HIPAA’s reach is defined by entity type: it applies to covered entities and business associates operating within the United States. Whether a patient holds EU citizenship is irrelevant to HIPAA jurisdiction. What matters is whether the organisation providing care or processing health data operates within the U.S. healthcare system. GDPR’s reach is defined by the location of the data subject, not the organisation. Article 3 of the GDPR gives it explicit extraterritorial effect. If your organisation targets or monitors EU residents, GDPR applies, regardless of where you are headquartered, where your servers are located, or what industry you operate in. Types of Data Protected: Personal Data vs Protected Health Information (PHI) This is the sharpest structural difference between the two frameworks. HIPAA is focused exclusively on health data in the context of healthcare delivery or payment. GDPR covers all personal data, from email addresses and IP addresses to medical records and genetic profiles. Health data under GDPR is a subset of the broader personal data category, not the totality of it. An organisation that is fully HIPAA-compliant may still be in violation of GDPR if it mishandles employee data, marketing data, or website analytics. Legal Basis for Data Processing GDPR requires organisations to identify a valid legal basis before processing any personal data. For health data, that typically means explicit consent or one of the specific derogations in Article 9(2), such as processing necessary for medical diagnosis or the provision of healthcare. This is a meaningful threshold; pre-ticked boxes, bundled consent, or vague terms of service do not meet GDPR’s standard. HIPAA takes a different approach. It permits covered entities to use and disclose PHI for treatment, payment, and healthcare operations without obtaining patient consent. Authorisation is required only in specific circumstances, such as disclosures for marketing purposes or release of psychotherapy notes. Important: GDPR’s explicit consent requirement creates real friction for U.S. healthcare organisations treating EU patients. A hospital cannot rely on its standard HIPAA-compliant intake forms to satisfy GDPR. The legal bases must be documented separately, and consent forms must meet the GDPR’s granularity requirements. Regulatory Authority and Enforcement HHS OCR is

ISO-27001

May 28, 2026

Employee Offboarding Checklist: 10 Steps to Revoke Access

31% of organizations have caught former employees accessing SaaS applications after their departure (source). Seventy percent of intellectual property theft happens in the ninety days surrounding a resignation announcement. The pattern is so consistent that auditors now treat termination day as one of the highest-risk windows on the security calendar. This article is a working employee offboarding checklist for IT, security, and HR teams who want to close that window cleanly. It walks through ten steps that revoke access without leaving gaps, then covers edge cases (remote workers, hostile exits, lost devices), the manual-versus-automation tradeoff, and post-offboarding monitoring. Use it as a baseline and adapt it to your environment. What Is Employee Offboarding and Why Does Access Revocation Matter? Employee offboarding is the structured process of separating a person from an organization: removing their access, recovering company property, documenting their exit, and updating records. The access revocation piece is the part where most programs fail quietly. Accounts get disabled in the identity provider but stay active in a dozen SaaS tools. Badges get collected but VPN tokens stay valid. The person is gone; the keys to the building are not. Why Employee Offboarding Is a Critical Security Risk Offboarding fails because access has multiplied faster than the processes designed to manage it. The average enterprise now operates somewhere between 275 and 660 SaaS applications depending on size, with employees touching dozens of them each week. Each application is a separate place that needs to be cleaned up, and each one creates an independent point of failure. The departing employee is a particularly acute version of this risk because the motivation to walk away with something often peaks during the same window that access is supposed to be revoked. The Cost of Leaving Access Open After Departure The financial picture is well documented. The 2025 Ponemon Cost of Insider Risks report puts the average annual cost of insider-related incidents at $17.4 million per organization, with containment taking an average of 81 days. Even when a departed employee never actively misuses their access, the existence of a forgotten account is enough to compromise a SOC 2 audit, trigger a breach notification, or create the credentialed beachhead that an outside attacker eventually exploits. The cases keep appearing. Cash App was breached in 2022 when a former employee accessed the records of 8 million customers after leaving. In May 2024, FinWise Bank disclosed that a former employee accessed internal systems after departure because access had never been fully revoked. Intel sued a former engineer in 2024 for downloading roughly 18,000 sensitive files in the days before he left. Ponemon’s 2025 report found that containment costs scale steeply with time. Incidents resolved in under 30 days averaged about $11 million, while those over 90 days averaged $17 million. The biggest variable is not detection capability. It is how fast access actually came down on day one. Compliance and Legal Implications of Incomplete Offboarding Access revocation is not a “best practice.” It is an explicit control requirement in nearly every framework against which an organization is likely to be audited. NIST SP 800-53 control PS-4 requires that on termination, organizations disable system access within an organization-defined time period, terminate or revoke any authenticators, and retrieve organizational property. ISO/IEC 27001 includes equivalent expectations under its Annex A controls for termination of employment. The AICPA Trust Services Criteria for SOC 2 cover this under Common Criteria CC6.2 and CC6.3, and auditors routinely pull a sample of terminated employees and verify timestamps in the identity provider against the HR system. GDPR adds a separate dimension. If a former employee still has access to the personal data of EU residents, that constitutes unauthorised processing under Article 32, and it is the controller’s responsibility, regardless of intent. HIPAA does the same for protected health information. Whatever the framework, the question an auditor or regulator will ask is the same: how quickly was access revoked, and can you prove it? Who Is Responsible for Employee Offboarding? Offboarding fails most often because no one owns the whole process. Four groups need to be in the loop, and each one has a distinct job. HR and People Operations HR is the source of truth for the termination event. Their job is to capture notice of departure, set the official last day, communicate timing to the rest of the business, and serve as the trigger that starts every downstream task. If HR does not record the termination in the HRIS, nothing automated will fire. IT and Security Teams IT executes the access teardown. They disable accounts in the identity provider, revoke SSO and OAuth tokens, remove SaaS application access, suspend email, and recover devices. Security teams typically run the audit trail and post-offboarding monitoring, and they are the ones answering when an account flagged six months later turns out to belong to a person who left in March. Legal and Compliance Legal handles NDA reminders, IP assignment confirmations, non-disclosure obligations, and any contractual surprises. Compliance owns the documentation: the evidence trail that proves the offboarding actually happened and met the relevant control requirements. For regulated industries this becomes audit evidence; for everyone else it becomes legal cover. Direct Managers Managers know things HR does not. They know which shared drives the person owned, which third-party vendors they had standing access to, which client passwords they may have rotated themselves, and which projects need a transition plan. A solid offboarding process forces the manager into the workflow with a checklist of role-specific items, because no central team can guess them. Employee Offboarding Checklist: 10 Steps to Revoke Access Without Leaving Gaps This is the core sequence. The order matters: starting with notification and inventory before disabling accounts means you do not lock the person out of a system you still need them to hand off. Step 1: Initiate Offboarding Immediately Upon Notice of Departure The moment notice is given — resignation, termination decision, or end of contract — the offboarding workflow should start. This means

Table of Contents