Offboarding Violations

This is the help text the console shows in the help panel on this page.

This report lists terminated employees who still have active access grants — a direct compliance violation and a significant security risk. These are accounts that were not properly deprovisioned after the employee left the organization.

Key Metrics

• Total Violations: Number of terminated employees with at least one active access grant.
• Avg Days Past Termination: How long, on average, access has persisted after the termination date.
• Longest Outstanding: The most extreme case — use this to set urgency for remediation.
• Total Active Grants: All active access grants still held by terminated employees.

Severity Coding

The Days Past column is color-coded:

• Blue (under 7 days): Recently terminated, likely an offboarding still in progress.
• Amber (7–29 days): Overdue — escalate to the asset owner.
• Red (30 days or more): Critical violation — revoke immediately and document the incident.

If an employee has no termination date on record, Terminated shows “Unknown” and the days count as 0 — add the end date on the employee record to get an accurate figure.

Table

Each row lists the employee, department, termination date, the assets where access is still Active, the number of active grants and the highest risk score among them. Longest violations come first.

Compliance Impact

Persistent access after termination violates ISO 27001 A.5.18, SOC 2 CC6.2, and most HR access policies. Each row in this report is a finding that must be remediated and evidenced before an external audit.