Onboarding, Transfer and Termination Checklist template: The steps, owners and time limits for granting, changing and removing a person's access when they join, move or leave, with a register of each personnel action, as SP 800-53 PS-3, PS-4, PS-5 and AC-2 require.
The steps, owners and time limits for granting, changing and removing a person’s access when they join, move or leave, with a register of each personnel action, as SP 800-53 PS-3, PS-4, PS-5 and AC-2 require.
The Human resources office starts a checklist when a hire, transfer or departure is approved, or when an external provider reports one (PS-7d).
Each owner completes their steps and records the date and their initials.
A step that does not apply is marked “not applicable” with the reason, not left blank.
The Human resources office closes the checklist when every step is done, records it in the register below, and keeps it Fill in: where and for how long.
Notify Fill in: personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization Typical: the account managers and system owners of the systems the individual has access to of the transfer
Human resources office
Within Fill in: time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization Typical: 24 hours
PS-5d, AC-2h.2
2
Review and confirm the need for current logical and physical access
Losing and gaining Supervisor
Before the effective date
PS-5a
3
Initiate the transfer actions: Fill in: transfer or reassignment actions to be initiated following transfer or reassignment Typical: a review of the individual’s access by the losing and gaining supervisors, removal of access the new position does not need, and the return or issue of keys, badges and equipment
Human resources office
Within Fill in: the time period within which transfer or reassignment actions must occur following transfer or reassignment Typical: 5 business days of the formal transfer action
PS-5b
4
Remove access the new position does not need, and grant approved new access
Account manager
With step 3
PS-5c, AC-2
5
Rescreen, if the new position has a higher risk designation
Human resources office
Before the new access is granted
PS-3b
6
Sign any new access agreement the new position requires
Human resources office
Before the new access is granted
PS-6c.1
7
Assign role-based training for the new role, if it needs it
For an involuntary termination, or one for cause, do steps 1 and 2 no later than when the person is told.
#
Step
Owner
When
Control
Done (date, initials)
1
Notify the account managers and system owners
Human resources office
Within Fill in: time period within which to notify account managers when users are terminated or transferred Typical: 24 hours, or the same day for privileged users
AC-2h.2
2
Disable all system access
Account manager
Within Fill in: a time period within which to disable system access Typical: 24 hours, or the same day for privileged users; for an involuntary termination, no later than when the individual is told
PS-4a
3
Revoke authenticators and credentials, including tokens, certificates and building passes
Account manager
With step 2
PS-4b
4
Change the authenticators of any shared or group account the person used
Account manager
With step 2
AC-2k
5
Conduct the exit interview, covering Fill in: information security topics to be discussed when conducting exit interviews Typical: the individual’s continuing duty not to disclose organizational information, the return of all organizational property and information, and that former credentials must not be used
Human resources office
By the last day, where possible
PS-4c
6
Retrieve devices, tokens, keys, identification cards, building passes and information
Supervisor
By the last day
PS-4d
7
Transfer ownership of the person’s files, mailboxes and systems
When the person works for an external provider, the provider must report a transfer or termination within Fill in: time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges Typical: 24 hours (PS-7d). That report starts the transfer or termination section above. Record the date the provider’s report arrived: Fill in: date.
FIPS 201-3 (January 2022) requires the FBI National Criminal History Check to be completed and favorably adjudicated before a PIV Card is issued to someone with no prior investigation (section 2.2), and requires the PIV Card to be terminated when a federal employee separates or a contractor no longer needs access to federal buildings or systems (section 2.9.4). Checked September 2026.
#
Step
Owner
When
Control
Done (date, initials)
F1
Confirm the investigation is initiated and the FBI National Criminal History Check is favorably adjudicated before PIV Card issuance
Human resources office
Onboarding, before PIV issuance
PS-3a
F2
Have the PIV Card issuer terminate the PIV Card
Human resources office
Termination, or a contractor’s transfer that ends the need for access
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.