PS-4 Personnel termination: requirements and evidence

PS-4 personnel termination: what the requirement asks for and why it is hard

An assessor testing PS-4 will ask how a departing person's access is removed and how the organization proves it was removed. PS-4 asks for system access to be disabled within a defined time period, authenticators and credentials to be terminated or revoked, exit interviews covering defined security topics, security-related property to be retrieved, and access to information and systems the person controlled to be retained or removed. The organization sets the time period, the exit interview topics and the list of property, so the first decision is to write those values down and make them enforceable. SP 800-53B allocates PS-4 to the low, moderate and high baselines, and the high baseline adds PS-4(2). PS-4 is not part of the privacy baseline.

The risk is orphaned accounts: a former employee's directory account stays enabled, a contractor's API token keeps working, or a shared administrative password is never rotated after the person who knew it leaves. The control is hard because access is spread across many places. A single identity directory may feed some applications, while others keep local user tables, cloud consoles, source code platforms, network devices, vendor portals and shared service accounts that no one maps to a person. Termination is also often triggered late, through an HR form that reaches IT after the employee has already left. Before the next assessment, the compliance lead should ask for a current list of every system where a person can hold access, then confirm which of them are removed automatically from the identity source and which need a manual ticket.

Assessors test PS-4 through examination of termination procedures, termination records and system account lists, interviews with personnel security and account management staff, and testing of the termination process itself. A useful check is to pick recent leavers from HR records and trace each one to disabled accounts, revoked tokens and returned equipment, then confirm the time taken against the organization's stated period. Federated and identity-broker platforms such as Keycloak, Zitadel and authentik's SCIM provider can remove access centrally and produce logs that show when deprovisioning happened. Those logs support the evidence, but they do not replace a defined process, and the organization still owns the decisions on timing, exit topics and retained access. Ask any implementation partner to confirm which applications their connectors actually cover before relying on them as evidence.

Which systems, people and accounts PS-4 covers in practice

PS-4 reads simply, but the effort depends on where the organization draws its boundary. The decisions below determine which accounts must be disabled, which credentials must be revoked and which people must be included in the termination process.

Systems that hold organizational accounts

Every system that stores or authenticates an organizational user is in scope for the disablement requirement, including directories, email, collaboration tools, source code hosts and cloud consoles. Start with the authoritative directory and trace which applications are provisioned from it and which keep local user tables. Each local table is a separate place where access must be removed, so inventory it before estimating the work. Confirm the list with system owners rather than relying on the identity team's records alone.

Impact level sets the depth of scope

Whether the system is categorized at low, moderate or high impact determines which control baseline applies. PS-4 applies at all three levels, but the high baseline adds PS-4(2), which expects additional termination actions. Confirm the impact categorization in the system security plan before scoping, because a system moved up a level changes both the enhancement and the evidence an assessor will request.

Contractor and third-party accounts

Accounts held by contractors, service bureaus and other external personnel count when they access organizational systems, even though the organization does not employ those people. Check whether each external provider's staff sign in through the organization's identity provider or through accounts the provider manages. The second model shifts termination to the provider, so the contract must require notice and the organization must still verify that access ended.

Shared and service accounts the person knew

A departing employee who knew the password to a shared administrator account, a service account or a break-glass login can still reach the system after their own account is disabled. Inventory these accounts, record who holds their credentials and plan a rotation that runs as part of every termination. Treat this as a separate effort from disabling the individual account, and confirm that rotation is tracked as evidence.

Federated and brokered sign-in

When users sign in through a central identity provider, disabling the upstream account may not stop access to applications that cached sessions or hold long-lived tokens. Map which applications trust the broker and how their sessions expire, then decide whether termination must also end active sessions. Keycloak and Zitadel both act as brokers for external identity providers, so their session and token settings belong in the scope review.

Physical and property scope

Security-related property such as badges, tokens, laptops and keys is also part of PS-4, so the scope includes physical access systems that issue or record those items. Confirm which facilities and devices the person used and whether badge systems are linked to the same termination workflow. Check that exit records show what was returned, what is outstanding and who approved any exception.

How an assessor tests PS-4 personnel termination

This table maps the five SP 800-53A determination statements for PS-4 to the assessment method, the evidence an assessor asks for, and the gaps that most often appear. Control IDs appear as PS-04 in CPRT and SP 800-53A labels, so search for that form when you cross-reference the assessment text. Use the rows as a checklist to confirm your termination evidence exists before an assessor asks for it.

Assessment step	Evidence requested	Common findings
Examine: termination procedure	The documented personnel termination procedure, showing the steps, owners, the defined time period for disabling access, and the security topics covered in exit interviews	Procedure exists but names no owner, sets no time period for disabling access, or was never updated after the organization changed systems
Examine: termination action records	Sample records of recent terminations showing when access was disabled, when authenticators were revoked, whether the exit interview happened, and when property was returned	Records are missing for some leavers, timestamps show access disabled after the defined period, or exit interview records are absent
Examine: list of system accounts	Current account listing for in-scope systems, reconciled against the HR separation list to find accounts that belong to people who have left	Active accounts belong to former staff or contractors, shared or service accounts have no named owner, or the account list is not reconciled with HR
Interview: personnel security staff	Confirmation that staff who run terminations know the procedure, the time period, and how exit topics and property recovery are handled	Staff describe steps that differ from the written procedure, or they cannot say who receives the termination notice
Interview: account management staff	Confirmation that account managers disable access, revoke authenticators, and handle access to information the departing person controlled when they receive a termination notice	Account managers rely on informal requests, do not know how to find all accounts for one person, or do not revoke tokens and keys held outside the directory
Test: end-to-end termination process	A test termination traced from HR notice through account disablement, authenticator revocation, property recovery and records, with results compared to the defined time period	The process breaks at a handoff between HR and IT, a federated or local account survives the test, or the access-retention step for the person's information is skipped

How to implement PS-4 in five steps

This sequence turns PS-4 from a policy statement into a repeatable offboarding process that an assessor can trace from an HR termination event through to disabled accounts, revoked credentials and retrieved property. Each step closes with a record the assessor can examine.

Define the disablement window and exit interview topics
The organization, through its personnel security owner and HR, writes down the time period within which system access must be disabled after employment ends, and the security topics the exit interview must cover, such as return of property, continuing confidentiality obligations and access to information the person controlled. PS-4 requires these values to be defined, so an assessor will not accept an undefined window. The output is an approved procedure with the numeric window and the interview checklist, version-controlled and linked to the PS-1 policy. Confirm the value with your own risk owners, since the control leaves it to the organization.
Inventory every account a departing person can reach
The platform team lists each system, application, directory, privileged account type, shared credential, SaaS tenant and network service that a person could access through their identity. Include local accounts on hosts and service accounts the person administered, because these are the paths most often missed. The output is an access inventory that maps each account type to its owner and to the method used to disable it. An assessor will compare this list against the list of system accounts examined under PS-4, so gaps here surface during testing.
Connect HR termination events to the identity lifecycle
HR marks the termination in the system of record, and that event triggers deprovisioning in the identity provider rather than relying on a manual ticket. In an open-source stack, an identity provider such as authentik can push user deletions and deactivations to target applications over SCIM 2.0 with a scheduled full sync, while FreeIPA or a central directory governs the source accounts. Confirm whether your identity provider supports your HR source and whether the sync interval meets your defined window. The output is a documented integration diagram and a sample event log showing one termination propagated end to end.
Revoke authenticators, tokens and keys
Disabling the account is not enough. The identity team revokes active sessions, refresh tokens, API keys, SSH keys, certificates, multifactor enrollments and any shared secrets the person held, and rotates credentials that were known to them. Single sign-on brokering through a platform such as Keycloak or Zitadel lets revocation at the identity layer cut off access to federated applications, but local credentials still need explicit handling. The output is a revocation checklist per account type and the audit records showing each revocation completed.
Test a termination and retain the evidence record
The team runs a test termination against a non-production or designated test identity, then checks that every account in the inventory is disabled inside the defined window, that credentials stop working, and that the exit interview and property return were recorded. Each real termination should then produce a closure record with timestamps, the approver, the revocation results and the property return confirmation. The output is a test report and a repeatable evidence template that an assessor can examine alongside the termination records and the account list. Schedule the test again after any change to the identity stack.

Open-source identity tools that support PS-4 evidence

Termination evidence depends on where a person's accounts live and how far a disabled identity reaches. The tools below cover directory records, single sign-on, provisioning into applications and external identity brokering, and each one answers a different part of the PS-4 question. Confirm each tool's behavior against the documentation for your version before relying on it in an assessment.

authentik SCIM provisioning

The authentik SCIM provider pushes user and group creations, changes and deletions to target applications over SCIM 2.0, and it deprovisions a user from the target when that user loses access to the application. For PS-4, the useful evidence is a deprovisioning event tied to the termination date, plus a sync record showing the account is gone from the target. Runs a full sync every hour, so confirm how long a removed account can remain active in a target between a directory change and the next sync. Confirm which applications accept SCIM and which need manual steps.

FreeIPA central directory records

FreeIPA uses 389 Directory Server as a multi-master LDAPv3 directory that stores users, groups, hosts and other network objects, with centralized access control and delegated administration through its web UI and command line tools. For PS-4, it gives assessors one place to disable an account, remove group memberships and show who held delegated administration rights at the time of departure. Check that disabling an account in the directory blocks the services that authenticate against it, and that the administrators who can change those records are themselves covered by the termination process. Licensed under GPL-3.0-or-later.

Keycloak single sign-on

Keycloak provides single sign-on so users authenticate with Keycloak rather than each application, and it supports OpenID Connect, OAuth 2.0 and SAML 2.0. For PS-4, one disabled account in Keycloak can cut off sign-in to every application that relies on it, which shortens the window between termination and access loss. The risk is that applications keeping local passwords or long-lived tokens can still allow access. Build a list of applications that do not federate through Keycloak and assign each one a manual revocation step. Licensed under Apache-2.0.

Zitadel identity brokering

Zitadel acts as a central identity broker so users can sign in through external identity providers such as Google, Microsoft Entra ID or Okta over OpenID Connect, SAML 2.0 or LDAP, without each application trusting each provider separately. For PS-4, the key question is whether the employee's access depends on the upstream provider. If the employer's identity provider disables the account but Zitadel keeps a local session or linked identity, access may persist. Confirm how brokered sessions end, and how revocation in the upstream provider reaches Zitadel. Licensed under AGPL-3.0-only, which carries network-use obligations if you modify and expose the software to users.

What evidence passes a PS-4 assessment

An assessor testing PS-4 looks for proof that each part of the control happened for real people, on real dates, and that the organization can show it repeatedly. The starting point is the written personnel termination procedure, which should name the defined time period for disabling system access, the owner of each offboarding step, and the list of security topics covered in exit interviews. Assessors check that the procedure matches what staff actually do, so ask a sample of account administrators and HR staff to walk through a recent leaver. Keep the procedure under version control, record its approval date, and confirm it is reviewed on the cycle your own policy sets. Ask your assessor which format they expect for the time period, since the value must be defined by the organization and visible in the document itself.

Termination records are the core evidence. For each leaver, the record should tie the HR separation date, the date access was disabled, the date authenticators and tokens were revoked, and the date property was returned into one traceable case. The account inventory supports this: export the directory and show that accounts for the sample leavers are disabled or removed, with the change timestamps retained in the directory or audit log. In an identity platform such as authentik, a SCIM provider deprovisions users from target applications when they lose access, so a disabled source account can be shown to have propagated downstream. Confirm in your own environment that these events are logged and retained, because the assessor will ask for them. Revocation logs for hardware tokens, certificates and API keys should be kept alongside the account records.

Exit interview records and property return receipts close the loop. Signed or dated interview records should show that the defined security topics were covered, and receipts should list equipment, badges and media returned. Illustrative example: a leaver's record shows access disabled on the separation date, a token revoked the same day, and a laptop receipt signed a week later, with the gap explained. Between audits, schedule a periodic reconciliation of HR leavers against active accounts, and treat any mismatch as a finding with an owner. Where a person retains access to information they controlled, such as a shared password vault or a document owner role, record the approval, the reason, the scope and the review date. Ask your auditor which reconciliation frequency and sample size they expect before you design the process.

What meeting PS-4 costs in money and effort

This table breaks down the cost components of meeting PS-4 Personnel termination, showing who is paid for each, whether it is one-time or recurring, what drives it up, and how to keep it down. NIST does not estimate compliance costs, so no figures appear here; use the table to build the questions you put to a written scope and quote.

Cost component	One-time or recurring	What drives it	How to keep it down
Tooling and licenses	Recurring where commercial; one-time setup in either case	Commercial identity suites charge per user or per module; self-hosted open-source platforms such as authentik, FreeIPA, Keycloak or Zitadel remove license spend but still need hosting and operating staff	Decide the system of record for joiner, mover and leaver data first, then size the platform to that scope; confirm licensing terms in writing before adoption
Engineering time for connectors and deprovisioning	One-time build, then recurring maintenance	Number of target applications, whether they support SCIM 2.0 or only manual accounts, and how many local or service accounts sit outside the identity provider	Start with applications that already support provisioning; document manual steps for the rest so the disabling deadline in PS-4 is still met
Procedure and policy writing	One-time, reviewed on a defined cycle	Number of departure paths (voluntary, involuntary, contract end, transfer), the exit interview topics the organization defines, and how many approvers are required	Write one termination procedure with a single checklist that HR, managers and IT all use; reuse the PS-1 policy structure
Evidence upkeep through reconciliation	Recurring	Frequency of departures, number of accounts, and whether HR and directory records are reconciled by hand or by automated report	Generate leaver reports from the directory and HR feed on a fixed schedule; keep the tickets and logs that show disabling times in one place
Exit interviews and property recovery	Recurring, staff time per departure	Headcount turnover, remote staff who must return equipment, and the number of security-related items such as tokens and badges	Use a standard exit checklist and ticketed return of property; track unreturned items to closure
External testing or review	Recurring or per engagement	Scope of the test (for example, whether access removal is tested end to end), whether the test covers contractors, and reporting depth	Agree the test scope in writing so it checks disabling timing and credential revocation rather than the whole identity program
Auditor or assessor sampling	Recurring, per assessment cycle	Number of terminations sampled, the completeness of records, and the time needed to produce evidence on request	Keep one retrievable record per departure linking HR notice, disabling time and revocation proof; ask the assessor for the sample method before fieldwork

Who owns PS-4: your team, a partner and the auditor

Your organization owns PS-4. HR, IT and security each hold a part of the termination process, and the control only works when the handoffs between them are written down and followed. HR starts the termination action and records the effective date. IT disables directory accounts, revokes authenticators and recovers devices. Security defines the time window for disabling access, owns the exit interview topics and reviews exceptions. Someone must also own the evidence: the termination records and account lists that an assessor will ask to examine.

Procedure ownership: A named owner maintains the termination procedure and approves changes to the time window and exit interview topics.
Identity system administration: Your staff configure the directory or identity provider, decide which applications receive deprovisioning, and manage exceptions.
Authenticator and credential revocation: Staff confirm that tokens, API keys, shared secrets and privileged credentials held by the leaver are revoked, not just the login.
Property recovery: HR and IT track returned laptops, badges and tokens against a checklist signed off at exit.
Evidence retention: Termination tickets, timestamps and account reports are kept in a form an assessor can examine.

Before any assessment, check that someone on your side can explain the full path from an HR termination record to the disabled account, and produce it for a sample of leavers.",

Where PS-4 programs usually fall short

Most PS-4 findings do not come from missing policy. They come from accounts that sit outside the joiner, mover and leaver process, or from records that nobody reconciles. The cards below cover the gaps assessors most often trace back to termination, with the fix for each.

Shared and service accounts

Shared logins and service accounts rarely have an owner in the HR system, so they are never reviewed when someone leaves. A departing administrator may still know the password to a shared account used for backups or monitoring. Check each shared or service account for a named owner, a documented credential rotation step in the termination procedure, and a review date. Where the platform supports it, replace shared logins with individual accounts that the identity provider can disable.

SaaS applications outside the identity provider

Applications that authenticate with local passwords sit outside any central disablement, so disabling the directory account leaves a working login behind. Inventory every application that holds organizational data and confirm each one either signs in through the identity provider or is covered by a documented manual deprovisioning step. For applications that support SCIM, the provisioning connector should remove access automatically when the user is deactivated.

Contractor accounts without end dates

Contractor and vendor accounts are often created for a project and never linked to a contract end date, so access outlives the engagement. PS-4 applies when the relationship ends, and the external personnel control (PS-7) requires the provider to notify the organization of staff terminations. Confirm that every non-employee account has an expiry date tied to the contract, and that the sponsor who requested access is recorded as the person responsible for ending it.

Authenticators and API tokens left active

Disabling a user does not revoke the tokens, personal access keys, SSH keys or API credentials that person created earlier. Those credentials can keep working against systems that do not check the user's account status on every request. Make revocation of authenticators, tokens and keys an explicit step in the termination checklist, and check the platform's session and token lifetimes so that active sessions also end when the account is disabled.

Exit interviews without records

An exit interview that happens but is not recorded gives an assessor nothing to examine. PS-4 expects exit interviews to cover the security topics the organization has defined, such as retained confidentiality obligations and return of property. Use a standard checklist, store the signed or dated record with the termination ticket, and keep the list of topics current with the policy so the record matches what the procedure requires.

No reconciliation of leaver lists

Terminations recorded in HR and accounts active in the directory drift apart when nobody compares them. Gaps usually appear where a leaver was processed by a manager outside the normal workflow or where an account was created outside HR. Run a periodic reconciliation between the HR leaver feed and the active account list, record the exceptions, and assign each one an owner and a closure date. The reconciliation report is the evidence that the termination process actually operates.

Questions buyers ask about PS-4 implementation and cost

How much effort does PS-4 personnel termination take to implement?

Effort depends mostly on how many systems hold accounts for employees and how many of those systems are connected to a central identity source. PS-4 asks for system access to be disabled within a defined period, authenticators and credentials to be revoked, exit interviews to cover defined security topics, security-related property to be recovered, and access to information the person controlled to be kept. Where every application takes its identity from one directory, most of the work is defining the procedure and testing the disablement path. Where accounts are local to many applications, the effort rises with each system that needs its own removal step and its own evidence. The biggest cost driver is usually the number of disconnected systems, not the control text itself. Ask any partner to base its quote on a written list of systems, account types and HR sources.

Can our own team implement PS-4 without an outside partner?

Yes, many organizations implement PS-4 in-house, and the control does not require an outside firm. The organization owns the control, its procedure, its HR process and its evidence. The questions to answer honestly are whether the team has time to build and test the identity and offboarding integrations, whether it can produce evidence on demand, and whether it has someone who can maintain the workflow as systems change. An outside partner can take over the build work, such as connecting an identity provider to target applications, configuring automated deprovisioning and documenting the runbook. The partner does not own the control or sign off on it. Internal teams often keep the policy and exit interview process while bringing in help for the technical build.

What does our side need to provide before an implementation partner starts?

The partner needs three inputs to plan the work: a system inventory, an authoritative HR feed and named owners. The system inventory lists each application, its hosting location, its account store and whether it already supports federated sign-on or provisioning. The HR feed identifies the source of truth for employment status and termination dates, and shows how terminations reach identity and access systems today. Named owners cover HR, the account management function, system owners for each application, and the person who approves exit interview topics and property recovery. Without these, the scope cannot be written precisely, and the quote will carry more uncertainty. Expect to supply sample termination records so the team can test the workflow against real timing and gaps.

How long does a PS-4 implementation take, and what changes the timeline?

The timeline depends on scope, and no duration applies until a written scope exists. The main variables are the number of systems to connect, whether an identity provider already exists, how many account types must be handled and how quickly the HR source can feed termination events. Testing with real leavers, exit interview process design and property recovery workflows also add time because they involve people outside IT. Organizations that already run a central directory with working deprovisioning usually have a shorter path than those with many local accounts. Ask for a timeline by phase in the proposal, with the client dependencies named, so delays in HR or system owner input are visible rather than hidden in the schedule.

What does a fixed-scope PS-4 engagement cover?

A fixed-scope engagement covers the deliverables and systems named in a written scope agreed before work starts. For PS-4, that typically means the agreed systems, the offboarding workflow, the configured integrations, the test results, the runbook and the evidence the client will keep. Items not in the scope, such as additional applications, new HR systems or policy drafting for the full personnel security family, are handled through a change to the written scope. Ongoing support, upgrades and continuous testing are available as retainers. Ask the partner to list what is excluded as clearly as what is included, and to state who performs each exit interview, property recovery and access review step after handover.

What does the auditor do that a implementation partner cannot?

Only an independent auditor, assessor or certification body can test the control and issue a report, attestation or certificate. The implementation partner prepares systems, configurations and evidence, but it cannot assess the organization's own controls or sign off that PS-4 is met. For a NIST SP 800-53 assessment, the assessor typically follows the SP 800-53A procedures, which include examining termination procedures and records, interviewing personnel responsible for termination and account management, and testing the process. Your organization decides which assessor to engage and who owns the findings. Ask the assessor which evidence formats it accepts before the partner builds the workflow.

Does self-hosted open-source identity software reduce PS-4 license spend?

Self-hosted open-source identity platforms can reduce recurring license fees for the identity layer, but they do not remove the cost of operating, integrating and evidencing the control. Authentik (MIT), FreeIPA (GPL-3.0-or-later), Keycloak (Apache-2.0) and Zitadel (AGPL-3.0-only) each offer central sign-on or directory features that can support automated deprovisioning. Authentik's SCIM provider, for example, pushes user deletions to target applications and runs a full sync every hour. The organization still pays for infrastructure, staff time, integration work, testing and support. Confirm each license's terms with its counsel, and compare total cost with any commercial identity product the organization already owns, using a written scope for the same systems.

How DeployOpen scopes and prepares PS-4 evidence

DeployOpen works on PS-4 by agreeing a written scope first, then building the offboarding path in the client's own infrastructure with self-hosted identity tooling. The output is a documented, testable set of termination records that the organization's own team and independent assessors can examine.

How we scope

Engagements are fixed-scope, with systems, deliverables and timelines agreed in writing before work starts.
Scope names the identity sources, applications and cloud accounts where termination must disable access within the organization's defined period.
Scope records who owns each step: HR trigger, identity administration, application owners and the exit interview process.

How we build

Configure the identity provider so one HR-driven deprovisioning event removes the person from every connected application.
Where an application lacks SCIM support, document the manual revocation steps, owners and evidence captured for each one.
Test termination end to end with a dated test account, recording when access stopped and which authenticators were revoked.

How we hand over

Deliver the termination procedure, role matrix and a record template covering disabled accounts, revoked credentials and returned property.
Provide exported logs and configuration evidence that map to the PS-4 determination statements for the organization's assessor to examine.
Walk the organization's staff through the runbook so the process keeps working after the engagement closes.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, covering identity platform changes that affect offboarding.
Retesting after new applications or identity sources are added keeps termination coverage current with the system inventory.
Confirm with your assessor which evidence format and retention period they expect before the first review.

PS-4 Personnel termination