CAIQ IAM-07: User access changes and revocation
By The Citesheet team · Published
Short answer
IAM-07 asks whether you remove or change access in a timely manner when people leave, change roles, or when a system identity changes. Your access control or offboarding policy proves it. The word to watch is "timely": a policy that says access is removed on termination is good, and one that gives a deadline, such as within one business day, is better.
What the control asks
IAM-07.1: Is there a process to de-provision or modify access, in a timely manner, for movers and leavers or when a system identity changes?
"Movers" are people who change role or team. "Leavers" are people who leave the company. "System identity changes" covers things like rotating a service account when the person who set it up leaves.
Which policy usually proves it
The Access Control Policy, in a section on termination and transfers, or an Offboarding procedure. HR checklists count as supporting evidence if they include an access removal step.
Quoted evidence from public policies
GitLab's policy has one line for leavers and one for movers:
Access is deprovisioned upon cessation of employment.
Access is deprovisioned or provisioned upon job transfer, as appropriate for the transfer.
GitLab Handbook, Access Management Policy, CC BY-SA 4.0.
Tailscale adds a deadline, which is what makes "timely" provable:
Terminated employees must have their accounts disabled within 1 business day of transfer or termination.
Tailscale, Access control policy, CC0.
and backs it up with reviews for the cases that slip through:
Transferred employee access is reviewed and adjusted as found necessary. Since there could be delays in reporting changes in user responsibilities, periodic user access reviews are conducted by the Security Review Team.
Tailscale, Access control policy, CC0.
How GitLab answered
Yes, in its CAIQ v4.0.3 submission on the CSA STAR Registry. GitLab's public policy does not give a deadline; it refers to an internal Access Management Standard for details.
A good answer, if your policy supports it
IAM-07.1: Yes. Leavers' accounts are disabled in [identity provider] within [1 business day] of their last day, which removes access to all SSO-connected systems; non-SSO systems are removed from the offboarding checklist. When someone changes role, their access is adjusted through an access request. Service account credentials owned by a leaver are rotated. See Access Control Policy, "Termination and transfers".
When N/A is honest
Never for a company with staff or contractors. A solo founder with no one else on any system can explain that, but should still describe what would happen when the first person joins or leaves.
Where answers usually go wrong
- "Timely" without a number. Reviewers may ask "how quickly?" If your policy has no deadline, treat "timely" as unproven and decide what your real number is before you write Yes.
- Non-SSO systems. Disabling the identity provider account doesn't remove local accounts, shared passwords or API keys the person created. Name how those are handled.
- Movers. Many policies cover leavers only. Role changes are where access quietly piles up.