Onboarding and offboarding controls for SOC 2

Why this matters

SOC 2 auditors test access at the edges of employment. They pick new hires and people who left, then ask who approved the access, when it was created and when it was removed. The control you need is a repeatable lifecycle process with a record at each step.

Most findings here are not exotic. An account stays active after the last day. A role change adds new permissions but keeps the old ones. A contractor works from a shared login. Each one is a gap between what your policy says and what your systems show.

Onboarding and offboarding also set the tone for access control. If accounts appear before approvals and linger after exits, periodic access reviews cannot fix the root cause. Start with the joiner, mover and leaver path, then use reviews to catch drift.

Before you start

Write down the rules before you touch a tool. Decide who can request access, who approves it, which roles get standard access bundles and how fast access must be removed. Set a target you can meet, such as same business day for involuntary exits and end of the last working day for voluntary ones. Publish the target and make managers aware of it.

List every system that holds company data or can change production. Include the identity provider, email, code host, cloud consoles, finance tools, support desk, password manager and device management. Note which systems use single sign-on and automated provisioning, and which still have local accounts. Mark privileged roles, shared accounts and API tokens.

Choose one source of truth for people. For employees, that is usually the HR system. For contractors and vendors, use a register with a sponsor, start date and end date. Pick a ticketing system for requests and a folder for evidence. Get HR and managers to agree on who sends the start and end dates, because the whole process depends on that trigger.

How to do it

Build one flow from trigger to close. Keep the ticket as the container for the request, approval, provisioning steps and proof. Name tickets with the person and event, such as onboard, move or leave. That makes sampling simple later.

Onboarding starts after a signed offer or contract and a start date. Approve the role bundle before you create accounts. A move starts with a manager request and ends with old access removed and new access added. A leave starts from the HR status change, not from a reminder in chat.

For leavers, cut the main door first. Disable the identity provider account and revoke active sessions, then work through downstream apps, devices and secrets. Record the time of each action. If a system cannot be automated, put it on a checklist with a named owner.

1. Connect HRIS to identity provider. Use SCIM where the app supports it, and map employee ID, manager, department and status. Test one rehire before you trust the feed.
2. Build a role catalog. Name each bundle by job family and level, and keep privileged access as a separate approval. Avoid bundles that grant more than the role needs.
3. Require an approved ticket. Route the request to the manager and the system owner. Save the approval in the ticket, not in chat.
4. Run onboarding from the ticket. Create the identity, enforce MFA, assign groups, then provision apps. Record the account ID and creation time.
5. Treat a role change as a new request. Open a move ticket and remove the old bundle as you add the new one. Capture before and after group lists.
6. Trigger offboarding from HR status. Open a leaver ticket on the last day, disable the identity, revoke sessions and remove groups. Suspend email or set an auto reply as your policy requires.
7. Reclaim devices, secrets and data. Check the device management tool for laptops and phones, rotate shared credentials, and transfer files to the manager. Record serial numbers and return dates.
8. Close the ticket with proof. Attach a system export, screenshot with a timestamp or log line. Note any exception and who approved it.
9. Sample the process every quarter. Pick a few hires, movers and leavers, compare HR records to active accounts and fix gaps. Keep the test results with the control.

How to check it worked

Reconcile the HR roster against the identity provider and your key apps. Anyone active in an app but missing from HR is an orphan account. Anyone terminated in HR but active in the identity provider is a missed leaver. Run this monthly and keep the export.

Sample the records. For hires, compare the start date with the account creation date and check that approval came first. For leavers, compare the last day with the disable time and session revocation. For movers, check that the old groups are gone.

Read the evidence as a stranger would. Can you tell who approved, what changed, in which system and when? A screenshot with no date or a ticket with no approver is weak. Fix the template before the audit, not during it.

Give the auditor a control description, the population and your sample. Walk through one ticket from start to finish. Keep the evidence index short and stable so you can find the same records again.

Mistakes to avoid

The common failure is a checklist with no owner. Accounts get created before the ticket, approvals live in chat and nobody records the disable time. Make the ticket the only path and give each step a named owner.

Do not delete accounts when someone leaves. Disable them and keep the record. Shared logins and API tokens are easy to forget, so put them on the leaver ticket. Contractors, interns and rehires need the same process.

Avoid broad bundles and permanent admin rights. A role change should remove old access, not stack new permissions on top. Keep a break glass account, log its use and review it after every use.

If you need a structured gap assessment, the SOC 2 readiness assessment from Cloudverg is one option at a fixed price of $7,500. It takes three weeks and includes a remediation roadmap. Other options include a consultant or an internal project, depending on your team.

Frequently asked questions