Joiner-mover-leaver deprovisioning

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

1. 1.Obtain and read the JML deprovisioning procedure; confirm it defines the 24-hour SLA and the HR trigger events (termination, transfer) that initiate it.PR.AA-01
2. 2.Confirm the deprovisioning workflow is triggered automatically from the HR system of record rather than a manual notification.
3. 3.Walk through the JML workflow configuration to confirm access across all in-scope systems is included, not just the primary directory.

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

1. 1.Select 25 terminations and transfers across the period and confirm access was removed within 24 hours.
2. 2.For sampled transfers, confirm access appropriate only to the prior role was removed even where some access correctly carried forward.PR.AA-01
3. 3.Confirm any deprovisioning that missed the SLA was identified and escalated.

Linked risks

• Privileged access misusemitigation 2

Framework mappings & latest test