Employee Offboarding Checklist: 20 NIS2 Steps for Revoking Access and Recovering Assets — and Why the CIR Sets No Hour Limit

Under NIS2, an employee offboarding checklist has three jobs: cut the leaver’s access, recover or wipe every company asset they hold, and leave a written record of both. Those duties come from four points in the Annex to Commission Implementing Regulation (EU) 2024/2690: 10.3, 11.2.2(b), 11.5.4 and 12.5. None of them sets a deadline in hours. The only phrase about speed is “without delay”, and it sits in the identity clause, not the access-rights one.

That matters because most offboarding checklists online were written for HR software buyers, not for auditors. This one gives you 20 steps, each with the clause behind it, an owner, an effort rating and the evidence it leaves. It also covers the two cases most templates skip: employees who change roles, and assets that never come back.

Which Rules Bind Your Offboarding Process

In plain terms: eleven types of digital provider are bound by the regulation’s exact wording. Every other NIS2 entity is bound by its national law, which turns the same Article 21(2)(i) duty into local rules. For them, the regulation is the most detailed EU benchmark available, but it is not the law they answer to.

Who you are	What binds your offboarding	What that means in practice
DNS service provider, TLD registry, cloud, data centre, CDN, managed service provider, managed security service provider, online marketplace, search engine, social network or trust service provider	Implementing Regulation 2024/2690, Article 1 and Annex (directly applicable)	Points 10.3, 11.2, 11.5 and 12.5 apply word for word. An auditor can quote them back to you.
Any other essential or important entity	Article 21(2)(i) NIS2 as transposed into your national law	You must have “human resources security, access control policies and asset management”. Your national law and authority set the detail; the Annex is a sound reference text.
Supplier to an in-scope entity, not in scope yourself	Your customer’s contract	Customers may write leaver controls into supplier clauses. For the eleven provider types, point 5.1.4(h) also asks that supplier contracts cover, where appropriate, what suppliers must do when the contract ends.

Article 21(2)(i) of Directive (EU) 2022/2555 names the three measures; Article 21(5) told the Commission to write detailed requirements for the eleven provider types and allows it to do the same for other entities. If you are unsure which row you sit in, run the NIS2 scope test first.

The Four Clauses Behind Every Leaver, and the Deadline None of Them Sets

In plain terms: one clause puts post-exit duties in the contract, two take access away, and one gets the hardware back. Read side by side, they show something offboarding guides miss: the regulation never says how fast.

Annex point	What it requires	Covers role changes?	Time wording
10.3.1–10.3.2	Security duties that survive the exit must be “contractually defined and enforced” and written into the terms of employment, “such as confidentiality clauses”	Yes: “termination or change of employment”	None
11.2.2(b)	Access rights are “modified accordingly upon termination or change of employment”	Yes	“upon”
11.5.4	Review identities regularly and, if no longer needed, “deactivate them without delay”	Indirectly	“without delay”
12.5	Assets in an employee’s custody are “deposited, returned or deleted upon termination of employment”, and each deposit, return and deletion is documented	No: termination only	“upon”

We searched the full Annex of Implementing Regulation (EU) 2024/2690 for any hour or day count tied to termination. There isn’t one. ENISA’s guidance on these points says access should be revoked “in a timely manner” and accounts disabled in a “timely” way. That is still not a number. The US federal catalogue does the same thing: control PS-4 in NIST SP 800-53 says to disable access “within [Assignment: organization-defined time period]”.

So the number is yours to set, and once you set it, you are tested against it. Point 11.2.1 requires access rights to be removed “in accordance with the access control policy”, so the auditor’s question becomes “did you meet your own deadline?” A policy that says “as soon as possible” can’t be tested, and that is where findings come from. A common practitioner standard is to disable the main identity by the end of the last working day, and earlier for dismissals. NIST’s own discussion of PS-4 notes that organisations “consider disabling the system accounts” of people being dismissed “prior to the individuals being notified”. Check whether your national authority has published anything stricter.

Point 10.3 has a second, quieter consequence: offboarding starts at onboarding. If the confidentiality clause and the duty to return equipment are not in the contract the employee signed on day one, you can’t add them on their last day.

The 20-Step NIS2 Offboarding Checklist

Run it from the moment HR confirms a departure. Effort ratings assume a small to mid-sized organisation; the ones marked High are usually the accounts that sit outside single sign-on.

Before the last day

Step	Anchor	Owner	Effort	Evidence it leaves
1. Open a leaver ticket with the confirmed last day and time	11.2.1	HR	Low	Ticket with timestamp
2. Pull the person’s entries from the access-rights register, including apps outside single sign-on, admin accounts and shared identities	11.2.2(e), 11.5.3	IT / IAM	Medium	Register extract
3. Pull every asset in their custody from the inventory	12.4.1, 12.5	IT	Low	Asset list attached to ticket
4. Hand over any security role they held (asset owner, approver, incident contact)	ENISA guidance on 10.3	Line manager	Low	Updated role assignment
5. Confirm the post-exit duties in their contract and prepare a written reminder	10.3.1–10.3.2	HR / Legal	Low	Copy of clause and letter
6. Tell the employee the date their mailbox closes, so they can remove private messages	GDPR (see below)	HR	Low	Notice sent
7. For dismissals, schedule account disabling at or before the moment of notification	11.2.2(b); NIST PS-4	Security + HR	Medium	Agreed timing in ticket

On the last day

Step	Anchor	Owner	Effort	Evidence it leaves
8. Disable (don’t delete) the main directory or SSO identity and end active sessions	11.2.2(b), 11.5.4	IT / IAM	Low	Directory log entry
9. Disable remote access, VPN and every app outside SSO	11.2.2(b)	IT	High	Per-app confirmation
10. Disable their separate admin or privileged accounts	11.3, 11.6.2(f)	IT	Low	Admin account log
11. Revoke MFA tokens, certificates, API keys and SSH keys issued to them	11.2.2(b); ENISA	IT	Medium	Revocation records
12. Collect laptop, phone, tokens, smart cards, keys and paper files, ticking each off the asset list	12.5	IT / Facilities	Low	Signed return list
13. Deactivate the building badge	11.1.1, 13.3	Facilities	Low	Badge system log
14. Block the mailbox and set an auto-reply naming a new contact, with no automatic forwarding	11.2.2(b); GDPR	IT	Low	Mailbox configuration
15. Hold an exit conversation covering confidentiality duties and get the exit checklist signed	10.3; ENISA on 12.5	HR	Low	Signed exit checklist

After departure

Step	Anchor	Owner	Effort	Evidence it leaves
16. Wipe returned devices and record the deletion	12.5, 12.2.2(b)	IT	Low	Wipe log per device
17. Cut network access for anything that did not come back	12.5 (second sentence)	IT	Medium	Block or isolation record
18. Rotate shared and break-glass credentials the person knew	11.5.3, 11.6.2(c)	Security	Medium	Vault rotation log
19. Check logs for any successful login after the disable time	3.2.3(b)–(d)	Security	Low	Saved query result
20. File the evidence, close the ticket and flag the leaver for the next access review	11.2.3, 11.5.4	Compliance	Low	Closed ticket and evidence pack

Step 19 depends on logging you may not have everywhere. Point 3.2.3 asks for logs of user creation and deletion, access and authentication events only “where appropriate”. The check still takes minutes where the logs exist, and it is the quickest proof that steps 8 to 11 worked.

Movers: The Half of 11.2.2(b) Most Checklists Skip

In plain terms: an employee who moves from finance to sales has not left, but their finance access has. The regulation treats that as a leaver event for access, though not for assets.

Points 10.3.1 and 11.2.2(b) both say “termination or change of employment”. Points 11.2.3 and 11.3.3 require access rights, including privileged ones, to be modified “based on organisational changes”. Point 12.5 speaks only of termination, which makes sense: a mover usually keeps the laptop. Two popular offboarding checklists we reviewed for this article didn’t mention role changes at all. Yet movers are where unneeded access builds up, because new rights get granted quickly while old ones are rarely removed.

For a mover, run five of the twenty steps: open the ticket (1), pull the register entries (2), hand over security roles (4), remove the old role’s rights at the same time the new ones are granted, never later (8–11, scoped to the old role), and check the new combination against separation of duties under 11.2.2(a). ENISA adds one step of its own: brief the person on the procedures that apply in the new role.

When an Asset Can’t Come Back: The 12.5 Fallback

The second sentence of point 12.5 is the one to plan for: where deposit, return or deletion “is not possible”, the entity “shall ensure that the assets can no longer access” its network and information systems. It applies to a personal phone with company email on it, a laptop a remote employee never posts back, or a contractor’s own equipment.

The duty, then, is to cut the asset off, not to wipe it. ENISA’s Technical Implementation Guidance suggests revoking credentials tied to the asset, moving it to a separate network segment, blocking its traffic at the firewall, disabling its network interfaces, and logging any later access attempts. Its list of assets to recover is wider than most checklists, too: alongside laptops and phones it names authentication hardware, physical copies of information, and vehicles that store or transmit data through telematics. For personal devices, ENISA’s advice is to trace company information, transfer it back and delete it securely from the device. Our guide to BYOD policy requirements under NIS2 covers that case in depth.

Disable First, Delete Later, and the Mailbox Rule

Deleting a leaver’s account on day one feels thorough, but it can destroy the audit trail you need if something later turns out to have happened. ENISA says so directly: disabling accounts “instead of deleting accounts, may be necessary to preserve audit trails”. Disable at once, then delete under your retention schedule. Our guide to NIS2 data retention covers how long to keep what.

The mailbox is where security and data protection meet. In decision 64/2020, the Belgian Data Protection Authority fined a company €15,000 for keeping a dismissed director’s address live for years with emails automatically forwarded. Its rules:

• Block the mailbox at the latest on the day the person actually leaves, after telling them in advance so they can sort out private messages.
• Set an automatic reply giving an alternative contact for a reasonable period, one month as a starting point and ideally no more than three for senior roles.
• Prefer the auto-reply to automatic forwarding.
• Delete the mailbox once that period ends.

It is a Belgian decision, not EU-wide law, but it rests on GDPR principles that apply across the EU: purpose limitation, data minimisation and storage limitation. Check your own regulator’s guidance. Usefully, it points the same way as NIS2: stop sign-in and delivery on the last day.

Shared Secrets and Admin Accounts

Point 11.5.3 allows shared identities only with “an explicit approval process and documentation”. If you follow it, you already have a list of shared accounts, so step 2 can identify every one the leaver used. Point 11.6.2(c) requires credentials to be changed “upon suspicion that the credentials were compromised”. It does not name an employee leaving as a trigger, so whether a routine departure calls for rotation is a risk decision you should record. Our view: rotate every shared and break-glass secret the person knew, and always after a dismissal. A vault that logs who checked out which credential, one of ENISA’s suggested controls, makes the “who knew it” question answerable in seconds.

Separate admin credentials under 11.6.2(f) are why step 10 is its own step. If the person’s admin account is a different identity, disabling their main account leaves it untouched. If your policy is built on ISO 27001, our ISO 27001 access control policy template shows where the leaver rules fit in the Annex A structure.

Who Owns Each Step

Role	Owns	Steps
HR	The trigger, the contract clauses, the exit conversation	1, 5, 6, 15
Line manager	Handing over roles and confirming what the person used	2 (confirm), 4
IT / IAM	Disabling, recovering and wiping	2, 3, 8–14, 16, 17
CISO / security	Timing of dismissals, shared secrets, log check	7, 18, 19
Compliance	Evidence pack and access-review follow-up	20
Management body	Approving the policy and overseeing it under Article 20(1) NIS2	Policy sign-off

If you run a small company without an identity platform, a shared spreadsheet register and one named IT owner cover most of the twenty steps. Write your deadline into the access control policy and keep the signed exit checklist. If you are a CISO, connect the HR system to the identity provider so step 8 fires from the HR record, the automated process ENISA prefers. Spend the saved effort on step 9, the apps outside single sign-on. If you are a compliance officer, sample leavers each quarter and compare the HR termination time with the disable timestamp. The HR side of the same lifecycle is covered in our guide to insider threat and HR policy under NIS2.

The Evidence File an Auditor Will Ask For

ENISA’s evidence examples and tips for points 10.3, 11.2, 11.5 and 12.5 add up to one file per leaver, plus two running records:

• A completed exit checklist with asset-return and data-deletion steps, signed by the departing employee and their supervisors
• Records showing assets were returned and access was revoked on time, measured against your own deadline
• Logs showing data on returned devices was deleted
• Copies of written notices to the employee about the end or change of their employment
• Access-register entries with the date each right was removed, plus system logs of the account changes
• A running list of leavers and the assets each returned, with return dates
• Results of periodic access and identity reviews (ENISA suggests identities be reviewed at least quarterly, or annually for micro-sized entities)

For the full picture of where these duties sit within Article 21(2)(i), see our NIS2 access control and HR security guide.

Frequently Asked Questions

Does NIS2 say how quickly access must be revoked when an employee leaves?

No. Neither the Directive nor the Annex to Implementing Regulation 2024/2690 sets an hour or day limit. Point 11.2.2(b) says “upon termination”, point 11.5.4 says “without delay”, and ENISA says “timely”. Set your own deadline in your access control policy and record that you meet it.

Does the checklist apply to contractors and temporary staff?

Mostly, yes. Points 10.3 and 12.5 refer to employees and personnel. Point 11.2.2(d) separately requires third-party access to be limited “in scope and in duration”, and ENISA applies its asset-return guidance to contractual relationships as well. For outsourced suppliers, point 5.1.4(h) asks that supplier contracts set out end-of-contract duties, such as retrieving and disposing of information, where appropriate.

Should we delete a leaver’s account straight away?

Disable it straight away and delete it later under your retention schedule. ENISA notes that deleting accounts can destroy audit trails you may need.

Is an exit interview mandatory?

The regulation doesn’t require one. ENISA suggests exit interviews “where deemed reasonably necessary” to remind leavers of their duties, and NIST lists them as part of PS-4. A short conversation plus a signed exit checklist covers the evidence either way.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

How This Guide Was Verified

Every Annex point above was checked against the official English text of Implementing Regulation 2024/2690 on EUR-Lex, which we downloaded and searched directly, not against secondary commentary. The same search confirmed that no hour or day limit appears in any termination clause. ENISA’s guidance was read in its full June 2025 PDF, NIST’s PS-4 text in SP 800-53 Revision 5, and the Belgian mailbox rules in the original French decision. Where a step rests on guidance or practitioner judgement rather than binding text, the article says so.

Sources

1. Commission Implementing Regulation (EU) 2024/2690, Article 1 and Annex points 3.2.3, 5.1.4, 10.3, 11.1–11.6, 12.2, 12.4, 12.5 and 13.3 — EUR-Lex
2. Directive (EU) 2022/2555 (NIS2), Articles 20(1), 21(2)(i) and 21(5) — EUR-Lex
3. ENISA, Technical Implementation Guidance on cybersecurity risk-management measures, version 1.0, June 2025 (points 10.3, 11.2, 11.5, 12.5)
4. NIST, Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations (control PS-4)
5. Belgian Data Protection Authority, Litigation Chamber, Decision on the merits 64/2020 of 29 September 2020