How to Build a Step-by-Step Termination Checklist to Protect CUI - NIST SP 800-171 REV.2 / CMMC 2.0 Level 2 - Control - PS.L2-3.9.2

Terminating access for departing personnel is one of the highest-risk moments for Controlled Unclassified Information (CUI) — and a properly scoped, tested termination checklist is the most reliable control small businesses can implement to meet NIST SP 800-171 Rev.2 / CMMC 2.0 Level 2 (PS.L2-3.9.2) requirements while reducing insider and accidental exfiltration risks.

Why a formal termination checklist is required

CMMC 2.0 Level 2 and NIST SP 800-171 require organizations to ensure that personnel who no longer require access to CUI are promptly denied further access and that organization-controlled assets are recovered or sanitized. For small businesses, informal or ad-hoc off-boarding drives gaps: forgotten cloud accounts, unattended VPN credentials, lingering SSH keys, or devices outside management. Those gaps translate into data theft, contract breaches, penalties, and lost business.

Step-by-step termination checklist (practical implementation for Compliance Framework)

Below is a practical, prioritized checklist you can adapt into your ticketing system and HR off-boarding workflow; treat it as a single workflow that combines HR, IT/Security, Facilities, and Legal actions and generates auditable evidence for compliance.

1. Initiation & Authorization: HR creates an off-boarding ticket with termination reason, effective timestamp, manager, and asset list; require manager + HR approval for off-boarding start time.
2. Account & Access Inventory: Pull the employee's accounts from Identity and Access Management (IAM), Active Directory/Azure AD, cloud consoles (AWS/GCP/Azure), VPN, SaaS applications (Okta/G-Suite/Office365), and SSH key inventories; list CUI repositories they accessed.
3. Immediate Access Suspension: At termination time (or earlier for terminations for cause) disable account logins, block credentials, and revoke sessions; document exact timestamps.
4. Credential Revocation & Rotation: Delete/revoke access keys, disable API tokens, remove OAuth grants, rotate any shared passwords or keys the person had access to (e.g., vaulted credentials), and revoke MFA tokens.
5. Device Recovery & Sanitization: Collect company laptops, mobile devices, badges, and hardware tokens; if remote, use MDM/EDR to wipe or revoke access (Intune/JAMF/Fleet) and cryptographically wipe drives before reuse.
6. CUI Handling: Reassign or transfer CUI ownership, secure physical files, update ACLs for shared folders, and ensure no CUI remains on personal devices; place legal holds if litigation or investigation pending.
7. Post-Termination Validation: Run automated scans (file servers, SharePoint, cloud buckets, email) for residual copies of CUI and verify removal/ACL changes; capture screenshots, logs, and ticket notes as evidence.
8. Audit & Reporting: Record all actions in the ticketing/audit system, preserve logs (auth, VPN, file access) for at least the required retention window, and schedule a 30/90-day review to verify no re-emergence of access.

Implementation notes — technical details and playbooks

Translate checklist steps into automation where possible. Examples:

• Active Directory: use a PowerShell playbook to disable accounts (Disable-ADAccount -Identity "jdoe") and remove group memberships, and log results to a central SIEM.
• Azure AD / Office365: run Set-AzureADUser -ObjectId user@domain.com -AccountEnabled $false or use Microsoft Graph to block sign-in and revoke refresh tokens.
• Okta / IdP: call Okta lifecycle endpoints to deactivate users via API (POST /api/v1/users/{id}/lifecycle/deactivate) and revoke sessions.
• AWS: delete or rotate IAM access keys (aws iam delete-access-key) and remove policy attachments; for federated roles, invalidate sessions by rotating the SAML provider trust or adjusting role sessions.
• SSH keys and Git: remove public keys from ~/.ssh/authorized_keys and Git hosting accounts, and rotate deploy keys or CI secrets that referenced the account.
• Endpoint management: issue a remote wipe or offboard command through Intune, Jamf, or your EDR (CrowdStrike, SentinelOne) and confirm device check-in.
• Secrets management: rotate Vault/Secret Manager entries the user could access; sever direct local access by revoking Vault tokens and updating service principals.

Real-world small business scenarios

Scenario A — Voluntary resignation, 40-employee company: HR opens an off-boarding ticket with 2-week notice; IT schedules deprovisioning for the last day at 5:00 PM. On that day, an automated script disables Azure AD credentials, removes cloud console roles, revokes Okta sessions, and triggers an inventory collector to deposit device return instructions. Device is returned and wiped with Intune; evidence stored in the ticket.

Scenario B — Termination for cause, 120-employee contractor shop: Immediate termination at 10:00 AM. HR triggers emergency-offboard: disable AD account (Disable-ADAccount), revoke AWS keys, remove VPN access, and request physical badge deactivation from facilities in parallel. Legal places a hold on the employee's mailbox and shared folders while Security performs an expedited search for exfiltration indicators in EDR and network logs.

Compliance tips and best practices

Implement these best practices to strengthen your compliance posture and make audits straightforward:

• Define and document SLA for access removal (e.g., immediate for cause, within 24 hours for voluntary separations) and enforce via workflow automation.
• Maintain a centralized identity inventory (single source of truth) and integrate HR, IAM, and ticketing systems so off-boarding triggers are reliable.
• Use least-privilege and role-based access control to reduce breadth of access to CUI — fewer accesses mean fewer revocations at termination.
• Preserve and centralize logs (auth, file access, EDR) for the retention window required by contracts and NIST guidance; store them immutable for forensic purposes.
• Run periodic access reviews and tabletop exercises for terminations to validate the checklist works and to find missed edge-cases like contractor subaccounts.
• Keep an evidence package per termination: ticket IDs, timestamps, commands run, device serial numbers, and signed receipts for recovered hardware.

Risks of not implementing this control

Failure to implement a reproducible termination checklist leaves CUI exposed in many ways: orphaned cloud sessions, leaked credentials, retained local copies on personal devices, and unrevoked service accounts. For businesses handling government or controlled data, these gaps can trigger noncompliance findings, contract termination, financial penalties, and reputational harm, in addition to enabling insider theft or unauthorized disclosure.

Summary — A well-documented, automated, and audited termination checklist is a low-cost, high-impact control that maps directly to PS.L2-3.9.2 and NIST SP 800-171 Rev.2 expectations: it reduces the attack surface at the moment of highest risk, creates verifiable evidence for assessors, and should be treated as a cross-functional playbook between HR, IT, Security, Facilities, and Legal. Start small, automate the high-risk revocations first (IdP, cloud keys, VPN, device wipe), and iterate with periodic reviews and tabletop tests to keep the checklist effective and auditable.