What to hand over when your IT or security admin leaves

When the person who runs IT or security leaves, the work comes in three parts. Management names a successor and tells the company. The successor gets admin rights before the old admin loses them, and every shared password the old admin knew is changed. Then the old admin’s access is removed, and each step is written down. Doing it in that order keeps an admin on every system and leaves the old admin with no working login.

Which rules cover the handover

NIST SP 800-53 is NIST’s catalog of security controls, which private companies may use on a voluntary basis. Its control PM-2 asks an organization to appoint a senior information security officer to run the security program. NIST’s crosswalk maps PM-2 to clause 5.3 of ISO/IEC 27001:2022 and to Annex A control A.5.2, so if you are certified, the handover touches those as well. ISO sells the standard’s text, so the controls below are NIST’s.

For the accounts themselves, two NIST controls apply. PS-4 covers someone leaving the company: disable their access within a time you set and revoke their passwords and any other means of signing in. PS-5 covers someone moving to another role: review whether they still need their current access and change it to fit the new job.

If your company is a financial institution under the FTC Safeguards Rule, there is also a named role. The rule requires a Qualified Individual to oversee, implement and enforce your security program (16 CFR 314.4(a)). If the person leaving held that role, name the new one. The FTC’s guide says the person doesn’t need a particular degree or title. The rule’s access requirements are in What the FTC Safeguards Rule requires for access, MFA and activity logs.

Write down what the old admin holds

Start with a list, and have the old admin check it before they go. Accounts only they know about may not show up any other way. CIS Safeguard 5.1, from the Center for Internet Security, asks for an inventory of all accounts, including admin accounts. It should list at least the person’s name, username, start and stop dates, and department. On a handover, the list should cover:

• Admin roles in each SaaS app, cloud console and domain or DNS account
• Shared logins whose password the old admin knows
• Phones or authenticator apps that receive two-step verification codes for any account
• Recovery email addresses and phone numbers that point to the old admin
• Security documents, policies and records the old admin owns

Which accounts count as admin accounts is in What is a privileged account?

The order to move things in

1. Name the successor in writing and tell the people who need to know. This is the start date for everything else.
2. Finish the list above with the old admin.
3. Give the successor admin rights in every system on the list. If you remove the old admin first, some app may end up with no one who can change its settings. PS-4 also asks you to keep access to the information and systems the leaver controlled.
4. Change every shared password the old admin knew, and move two-step verification to the successor. NIST SP 800-53 asks for shared and group account passwords to change when someone leaves the group (AC-2k, IA-5i). Removing a person’s user doesn’t stop them from typing a shared password they remember. Doing this every time someone leaves has limits, covered in The limits of changing shared passwords every time someone leaves.
5. Remove the old admin’s admin roles and other access. CIS Safeguard 6.2 asks for a process that disables accounts immediately when someone leaves, loses rights or changes role. It adds that disabling instead of deleting may be needed to keep audit trails.
6. Update the account list, the list of who holds which role, and recovery contacts.

Use the handover to fix how admin rights are set up. CIS Safeguard 5.4 asks that admin rights sit in dedicated admin accounts, with everyday email and browsing done from a normal account. SP 800-53 AC-6(5) asks you to restrict privileged accounts to named people or roles. Having two named admins per system means one can leave without a gap.

Records to keep

Keep the records that show each step happened, in a place the next admin can find.

If you are certified to ISO/IEC 27001, NIST maps AC-2 and AC-6 to Annex A controls A.5.18 and A.8.2, which cover these access and admin rights. What those controls cover for SaaS accounts is in ISO 27001 access controls for SaaS accounts.