SOC 2 offboarding: removing access, provably

Why offboarding is a control, not a checklist

SOC 2’s logical access criteria require that access is removed when it’s no longer appropriate — and a departure is the clearest case of that. Timely deprovisioning on termination is a common control used to demonstrate it. SOC 2 doesn’t name a required number of hours or a mandatory procedure; your policy sets the target (for example, revoke on the last day), and the auditor tests whether you met your own target consistently and can prove it. The gap auditors find isn’t usually “access was never removed” — it’s “you can’t show when, or by whom, so we can’t rely on the control.”

What termination-access testing looks like

Expect the auditor to take a sample of leavers and, for each, look for:

• A complete list of the systems and access the person held before they left.
• Evidence each grant was revoked, with a timestamp tied to the target date in your policy.
• Handling of shared or privileged access — admin rights, service accounts, and anything they alone owned.
• A trail showing who initiated and completed the removal, not just that it’s gone now.

The hard parts small teams miss

Two things reliably slip. First, ownership: when a leaver was the sole business owner or admin of a system, revoking their access shouldn’t orphan the system — someone has to inherit it. Second, timing across time zones and scheduled departures: a “remove on the last day” policy means the last day in the leaver’s time zone, not the server’s. Useboards routes a replacement ticket to the right owner for anything the leaver held, and applies a 5pm cut-off in the leaver’s own time zone so a scheduled offboarding fires when your policy says it should.

Evidence that the removal happened

The difference between “we deactivated them” and passing the test is a record. Every revocation in Useboards is a tracked action, and every action lands in an append-only, tenant-isolated audit log — a Postgres trigger rejects edits and deletes on the log, so the trail is tamper-evident. When the auditor samples a leaver, you can show the systems they held, the revocation of each, the timestamp, and the completion gate that confirmed nothing was left open.

For-cause vs. standard departures

Not every exit is a two-week notice. Useboards separates the scheduled path (revocations timed to the last day, with confirmation gates) from a “revoke all now” path for for-cause terminations that need immediate removal. Both produce the same evidence; only the timing changes. Completion is gated — an offboarding isn’t marked done until the last day has passed and every item is actually closed — so “mostly cleaned up” can’t masquerade as finished.