Which choice below MOST accurately describes the organization’s
responsibilities during an unfriendly termination?
A.
The employee should be given time to remove whatever files he
needs from the network.
B.
Cryptographic keys can remain the employee’s property.
C.
System access should be removed as quickly as possible after
termination.
D.
Physical removal from the offices would never be necessary.
Explanation:
Friendly terminations should be accomplished by implementing a
standard set of procedures for outgoing or transferring employees.
This normally includes:
Removal of access privileges, computer accounts, authentication
tokens.
The control of keys.
The briefing on the continuing responsibilities for confidentiality
and privacy.
Return of property.
Continued availability of data. In both the manual and the electronic
worlds this may involve documenting procedures or filing
schemes, such as how documents are stored on the hard disk,
and how they are backed up. Employees should be instructed
whether or not to clean up their PC before leaving.
If cryptography is used to protect data, the availability of cryptographic
keys to management personnel must be ensured.
Given the potential for adverse consequences during an unfriendly
termination, organizations should do the following:
System access should be terminated as quickly as possible when
an employee is leaving a position under less-than-friendly terms.
If employees are to be fired, system access should be removed at
the same time (or just before) the employees are notified of their
dismissal.
When an employee notifies an organization of the resignation
and it can be reasonably expected that it is on unfriendly terms,system access should be immediately terminated.
During the notice of termination period, it may be necessary to
assign the individual to a restricted area and function. This may
be particularly true for employees capable of changing programs
or modifying the system or applications.
In some cases, physical removal from the offices may be necessary.
Source: NIST Special Publication 800-14 Generally Accepted Principles
and Practices for Securing Information Technology Systems.