# Onboarding, Transfer and Termination Checklist

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/onboarding-transfer-and-termination-checklist/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** This checklist ties the personnel controls to account management (AC-2l asks for the two processes to be aligned). Start a copy for each personnel action, and keep the completed copy: it is the evidence assessors ask for when they sample recent hires, transfers and departures. Most organizations automate part of it through a feed from the human resources system to the identity provider; the checklist still records who confirmed each step. Time limits here must match the policy.

| Organization | Checklist owner | Last updated | Updated by |
| --- | --- | --- | --- |
| [Organization name] | [Human resources office] | [Fill in: date] | [Fill in: name and title] |

## How to use this checklist

- The [Human resources office] starts a checklist when a hire, transfer or departure is approved, or when an external provider reports one (PS-7d).
- Each owner completes their steps and records the date and their initials.
- A step that does not apply is marked "not applicable" with the reason, not left blank.
- The [Human resources office] closes the checklist when every step is done, records it in the register below, and keeps it [Fill in: where and for how long].

| Person | Organizational unit or employer | Action | Effective date | Checklist started by |
| --- | --- | --- | --- | --- |
| [Fill in: name or identifier] | [Fill in: unit or employer] | [Fill in: onboarding, transfer or termination] | [Fill in: date] | [Fill in: name] |

## Onboarding

| # | Step | Owner | When | Control | Done (date, initials) |
| --- | --- | --- | --- | --- | --- |
| 1 | Confirm the position's risk designation and the screening it requires | [Human resources office] | Before the offer | PS-2 | |
| 2 | Complete screening for the position | [Human resources office] | Before access | PS-3a | |
| 3 | Get the signed access agreement and Rules of Behavior | [Human resources office] | Before access | PS-6c.1, PL-4 | |
| 4 | Complete security and privacy literacy training | [Supervisor] | Before access | AT-2a.1 | |
| 5 | Submit and approve the [access request](https://kston83.github.io/nist-guide/templates/forms/access-request-form/) for each system | [Supervisor] | Before access | AC-2e | |
| 6 | Create accounts and issue authenticators | [Account manager] | After steps 2 to 5 | AC-2, IA-5 | |
| 7 | Issue a building pass and devices, and record them (the pass in the [physical access list](https://kston83.github.io/nist-guide/templates/forms/physical-access-list/)) | [Fill in: facilities or IT asset owner] | First day | PE-2, CM-8 | |
| 8 | Assign role-based training, if the role needs it | [Supervisor] | Before duties begin | AT-3 | |

## Transfer

| # | Step | Owner | When | Control | Done (date, initials) |
| --- | --- | --- | --- | --- | --- |
| 1 | Notify [Fill in: personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization. Typical: the account managers and system owners of the systems the individual has access to] of the transfer | [Human resources office] | Within [Fill in: time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization. Typical: 24 hours] | PS-5d, AC-2h.2 | |
| 2 | Review and confirm the need for current logical and physical access | Losing and gaining [Supervisor] | Before the effective date | PS-5a | |
| 3 | Initiate the transfer actions: [Fill in: transfer or reassignment actions to be initiated following transfer or reassignment. Typical: a review of the individual's access by the losing and gaining supervisors, removal of access the new position does not need, and the return or issue of keys, badges and equipment] | [Human resources office] | Within [Fill in: the time period within which transfer or reassignment actions must occur following transfer or reassignment. Typical: 5 business days] of the formal transfer action | PS-5b | |
| 4 | Remove access the new position does not need, and grant approved new access | [Account manager] | With step 3 | PS-5c, AC-2 | |
| 5 | Rescreen, if the new position has a higher risk designation | [Human resources office] | Before the new access is granted | PS-3b | |
| 6 | Sign any new access agreement the new position requires | [Human resources office] | Before the new access is granted | PS-6c.1 | |
| 7 | Assign role-based training for the new role, if it needs it | Gaining [Supervisor] | Before duties begin | AT-3 | |

## Termination

For an involuntary termination, or one for cause, do steps 1 and 2 no later than when the person is told.

| # | Step | Owner | When | Control | Done (date, initials) |
| --- | --- | --- | --- | --- | --- |
| 1 | Notify the account managers and system owners | [Human resources office] | Within [Fill in: time period within which to notify account managers when users are terminated or transferred. Typical: 24 hours, or the same day for privileged users] | AC-2h.2 | |
| 2 | Disable all system access | [Account manager] | Within [Fill in: a time period within which to disable system access. Typical: 24 hours, or the same day for privileged users; for an involuntary termination, no later than when the individual is told] | PS-4a | |
| 3 | Revoke authenticators and credentials, including tokens, certificates and building passes | [Account manager] | With step 2 | PS-4b | |
| 4 | Change the authenticators of any shared or group account the person used | [Account manager] | With step 2 | AC-2k | |
| 5 | Conduct the exit interview, covering [Fill in: information security topics to be discussed when conducting exit interviews. Typical: the individual's continuing duty not to disclose organizational information, the return of all organizational property and information, and that former credentials must not be used] | [Human resources office] | By the last day, where possible | PS-4c | |
| 6 | Retrieve devices, tokens, keys, identification cards, building passes and information | [Supervisor] | By the last day | PS-4d | |
| 7 | Transfer ownership of the person's files, mailboxes and systems | [Supervisor] | Before accounts are removed | PS-4e | |
| 8 | Remove accounts, or keep them disabled, as the [account management procedure](https://kston83.github.io/nist-guide/templates/procedures/account-management-procedure/) says | [Account manager] | [Fill in: when, for example after 30 days] | AC-2f | |

## External personnel

When the person works for an external provider, the provider must report a transfer or termination within [Fill in: time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges. Typical: 24 hours] (PS-7d). That report starts the transfer or termination section above. Record the date the provider's report arrived: [Fill in: date].

### Federal systems

[FIPS 201-3](https://csrc.nist.gov/pubs/fips/201-3/final) (January 2022) requires the FBI National Criminal History Check to be completed and favorably adjudicated before a PIV Card is issued to someone with no prior investigation (section 2.2), and requires the PIV Card to be terminated when a federal employee separates or a contractor no longer needs access to federal buildings or systems (section 2.9.4). Checked September 2026.

| # | Step | Owner | When | Control | Done (date, initials) |
| --- | --- | --- | --- | --- | --- |
| F1 | Confirm the investigation is initiated and the FBI National Criminal History Check is favorably adjudicated before PIV Card issuance | [Human resources office] | Onboarding, before PIV issuance | PS-3a | |
| F2 | Have the PIV Card issuer terminate the PIV Card | [Human resources office] | Termination, or a contractor's transfer that ends the need for access | PS-4b | |

## Register

| Person | Organizational unit or employer | Action | Effective date | Notice received | Access disabled or changed | Property returned | Checklist closed | Closed by | Where the checklist is kept |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: name or identifier] | [Fill in: unit or employer] | [Fill in: onboarding, transfer or termination] | [Fill in: date] | [Fill in: date and time] | [Fill in: date and time] | [Fill in: date] | [Fill in: date] | [Fill in: name] | [Fill in: location] |