How fast must access be removed after someone leaves?

No source we fetched gives an AICPA number. Strike Graph shows default control wording of 48 hours and says to set your own window, because the auditor tests against the period you define. ITJones recommends 24 hours. The risk is a gap between your written window and your tickets: Strike Graph says a policy of 24 hours with a ticket showing removal at 48 can lead to a finding or exception in the report.

Is disabling the SSO account enough?

Probo says no: disabling the SSO account is not offboarding, because tools with their own user tables, tools bought on a company card or joined with a personal email, and API tokens can keep working. A personal access token keeps working after the human account is gone. Probo sells offboarding software, so treat this as a vendor's view and check your own list of non-SSO tools.

Which criterion covers offboarding, CC6.2 or CC6.3?

Our sources do not settle it. Probo cites CC6.2, which it says asks that access be removed when it is no longer required. Strike Graph names no criterion, and ITJones names none either. Ask your CPA firm which control in your system description carries offboarding, and write that control's wording to match what you actually do.

What if we keep a former employee's account for continuity?

Strike Graph says the ticket should note that the former employee can no longer sign in to it, because the password was changed or the account was deactivated. Without that note, an account that stays active after the termination date looks like missed offboarding.

Do contractors count as leavers?

Treat them that way. ITJones gives an example of a contractor's cloud access key that stayed active five days past the contract end date, caught by an hourly check. Put contractor end dates in the same list the auditor will sample. See the contractors guide for how the roster is built.

SOC 2 offboarding evidence: what to show for people who left

Updated 1 November 2026

For people who left, the auditor starts from the HR or payroll list of terminations in the period, picks a sample, and asks for the ticket or checklist that shows each person's access was removed within the interval your control states (Strike Graph). Keep four things per person: the termination date from HR, the ticket, the log showing the account disabled, and proof that sessions and tokens were revoked. The window in your own written control is the one that gets tested, so write the one you will meet. These sources are vendors and a managed IT firm, not the AICPA, so confirm sampling with your CPA firm.

How the auditor samples leavers

Strike Graph describes the Type 2 test in two steps: a termination list "generated from HRIS or payroll" for the review period, then, for each sampled person, the full access termination ticket or offboarding checklist, checked against the interval in the control (Strike Graph). Probo says that in practice the auditor picks three or four people who left, and asks you to prove their access is gone (Probo). Probo gives no sample-size rule, and a leaver population can be zero in a small company. For how sample sizes work in general, see the sampling guide.

The record to keep for each person

Record	What it proves	Where it comes from
Termination date	The clock start the auditor measures from	HR or payroll system
Offboarding ticket or checklist	Someone was told and the steps were done in order	Offboarding checklist
Account-disabled log	The identity provider account was disabled, with a timestamp	Identity provider admin log
Sessions and tokens revoked	Disabling the sign-in did not leave a working token behind	Each app's token or session list
Continuity note	Any account kept active is no longer reachable by the leaver	The ticket (Strike Graph)

ITJones adds that evidence should be contemporaneous, meaning it shows the control ran when it was supposed to, and gives an example where a backdated ticket was exposed because the timestamps did not match the approval date (ITJones). Create the ticket on the day, not at audit time.

The timing trap

Strike Graph shows default control language of "revoked within 48 hours of termination or transfer," says to customize it to your actual window, and warns that auditors test against the period you define. If the policy says 24 hours and the ticket shows removal at 48, that can lead to a finding or exception in the audit report (Strike Graph). ITJones recommends revoking access within 24 hours of departure (ITJones). None of these is an AICPA number. Pick a window you can meet on a Friday afternoon, write that, and log the misses.

Where offboarding fails

Tools outside SSO. Probo says disabling the SSO account is not offboarding, and that access lingers in tools bought on a company card, tools joined with a personal email, and tools with their own user tables (Probo). List these tools before the period starts.
Tokens and keys. Probo notes a personal access token keeps working after the human account is gone (Probo). ITJones describes a contractor's cloud access key that stayed active five days past the contract end (ITJones).
Accounts kept for continuity. Strike Graph says the ticket should note the former employee can no longer access the account because the password was changed or it was deactivated (Strike Graph).
An access review is not a removal. Probo says a review records decisions and does not revoke anything (Probo). Run both: see the access review frequency guide and the access review sheet.

Which criterion, CC6.2 or CC6.3?

The sources do not agree on a label. Probo cites CC6.2, which it says asks that access be removed when it is no longer required (Probo). Strike Graph and ITJones name no criterion. Your CPA firm maps controls to criteria in the system description, so ask which control carries offboarding and describe it the way you really run it.

What the generated policy says

Policyseed sells a kit, so read these as one example, not a requirement. The generated Access Control Policy sets the window and the steps, and the Human Resources Security Policy repeats the timing for people operations. Change the intervals to what you will meet.

When a person leaves Northwind Cloud Inc, their identity provider account is disabled and their sessions revoked before the end of the last working day, and all other access is removed within one business day. When a person changes role, access the new role does not require is removed within five business days.
Access Control Policy, item 4.11

Offboarding and role changes. When People Operations confirms a departure, Engineering disables the Okta account, revokes sessions and tokens, removes membership of GitHub and AWS and Vercel, and rotates any shared or break-glass credentials the leaver could have known. The checklist is completed on the last working day and verified by the Security Owner within one business day. For internal moves, Engineering removes any access the new role's matrix entry does not require within five business days.
Access Control Policy, item 5.4

Non-human identities such as service accounts, API keys, deploy keys and integration tokens have a named human owner, a documented purpose, the narrowest permissions that fulfill it, and an entry in the service account inventory. They are never used interactively and are rotated at least annually and immediately when a person who knew the secret leaves.
Access Control Policy, item 4.9

Run each departure on the offboarding checklist, check who is still active with the access review tool, and log a missed window in the exception register. The roster for contractors is covered in the contractors guide.

Where the sources are thin

Dates. Strike Graph's help article and Probo's post show no publication date on the page; ITJones is dated 6 August 2026.
Vendors. Strike Graph and Probo sell compliance or offboarding software, and ITJones sells managed IT services. ITJones lists no specific offboarding artifacts, so the table above relies on Strike Graph.

Frequently asked questions

What does a SOC 2 auditor ask for about people who left?: Strike Graph describes it this way: a termination list generated from the HR or payroll system for the review period, from which the auditor selects a sample, then for each sampled person the access termination ticket or offboarding checklist, checked against the interval your control states. Probo says in practice the auditor picks three or four people who left and asks you to prove their access is gone. Neither gives a fixed rule, so ask your CPA firm how it samples.
How fast must access be removed after someone leaves?: No source we fetched gives an AICPA number. Strike Graph shows default control wording of 48 hours and says to set your own window, because the auditor tests against the period you define. ITJones recommends 24 hours. The risk is a gap between your written window and your tickets: Strike Graph says a policy of 24 hours with a ticket showing removal at 48 can lead to a finding or exception in the report.
Is disabling the SSO account enough?: Probo says no: disabling the SSO account is not offboarding, because tools with their own user tables, tools bought on a company card or joined with a personal email, and API tokens can keep working. A personal access token keeps working after the human account is gone. Probo sells offboarding software, so treat this as a vendor's view and check your own list of non-SSO tools.
Which criterion covers offboarding, CC6.2 or CC6.3?: Our sources do not settle it. Probo cites CC6.2, which it says asks that access be removed when it is no longer required. Strike Graph names no criterion, and ITJones names none either. Ask your CPA firm which control in your system description carries offboarding, and write that control's wording to match what you actually do.
What if we keep a former employee's account for continuity?: Strike Graph says the ticket should note that the former employee can no longer sign in to it, because the password was changed or the account was deactivated. Without that note, an account that stays active after the termination date looks like missed offboarding.
Do contractors count as leavers?: Treat them that way. ITJones gives an example of a contractor's cloud access key that stayed active five days past the contract end date, caught by an hourly check. Put contractor end dates in the same list the auditor will sample. See the contractors guide for how the roster is built.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.