ISACA outlines safeguards for former employee data

What happened

ISACA published guidance on its website on 10 October 2025 setting out how organisations should secure former employee data, from closing accounts to controlling access to archived emails and files.

The article, written by cybersecurity professional Alfonso Lopez Moreno, proposes a documented departure process covering IT, human resources and management responsibilities. It addresses the information left behind after employment ends, rather than reporting a data breach, arrest or court case.

According to the ISACA article, poorly managed accounts and records can expose personal information, disrupt business communications and create legal difficulties. Its approach combines access restrictions with rules governing what an organisation may retain, retrieve and delete.

Account deactivation is an essential starting point. The guidance recommends preventing further use of former employees’ accounts and managing their removal in line with retention policies and applicable legal obligations.

For mailboxes, Lopez Moreno proposes changing the password immediately after departure and recording when the action took place and who performed it. This separates the employee’s ability to access the account from any temporary business need to manage incoming correspondence.

An automatic reply would then tell senders that the mailbox is due to be disabled in 30 days. The proposed transition period is intended to allow relevant communications to reach appropriate colleagues without losing important business messages.

After that period, the article recommends exporting the mailbox to a personal storage table, or PST, file—an email archive—or backing it up in cloud storage. Where a PST file is created, the proposed procedure calls for encrypted copies on both a physical storage device and in the cloud, accessible only to authorised personnel.

The organisation should record the archive’s encryption password, storage locations and designated custodians. These records are intended to make responsibility for the stored information clear and allow the handling process to be audited.

The background

The article uses offboarding security to describe the steps taken to protect information when someone leaves an organisation. These extend beyond disabling a login to include handling mailboxes, storing documents securely and setting limits on later searches.

The insider-risk issue is therefore broader than whether a former employee can still sign in. Archived business records can themselves become a source of exposure if remaining staff can browse them without a justified purpose or if copies are retained indefinitely.

Related guidance from LeadingIT on revoking former employee access addresses another part of this problem: connected applications, shared files and company information on personal devices. Its focus shows why closing a main account and governing the records associated with it are distinct tasks.

Privacy remains relevant even where an employer prohibits personal use of work systems. Lopez Moreno notes that staff may nevertheless leave sensitive personal material in workplace mailboxes or on company devices, requiring care when business information is retrieved.

Retention introduces a separate tension. Keeping records unnecessarily increases the amount of information that could be exposed, while deleting them too soon can undermine an audit, a legal defence or an operational handover.

The ISACA article refers to the EU General Data Protection Regulation’s storage limitation principle: identifiable personal information should not be held longer than necessary for its purpose. It stresses that organisations must examine applicable local law and the type of information involved when setting their own schedules.

Its example retention table distinguishes between payroll information, stored emails, employee files, access logs and financial records. These are illustrative starting points rather than a single retention deadline applying to every former employee’s data.

The article’s 30-day mailbox transition should likewise not be read as a universal legal requirement. It also gives an example of an internally approved three-month maximum for mailbox retention, while separately discussing longer retention of archived records where justified.

What people are saying

Lopez Moreno says the procedure draws on his experience in corporate environments and is intended to align information handling with privacy, governance and legal requirements. ISACA’s author biography describes him as having more than 20 years of experience in cybersecurity, data protection and compliance work.

He argues that management, HR and IT can underestimate the risks associated with former employees’ digital records. The article says inadequate mailbox handling can result in missed communications, regulatory penalties and the loss of evidence needed in legal proceedings.

For later retrieval, Lopez Moreno recommends targeted searches using defined terms, such as a project name, an email address or a specific document name. He says unrestricted browsing of a mailbox or its archive should not be permitted.

The guidance calls for authorised staff to perform searches in controlled environments and to document the process. Records should include the search terms, the person accessing the information, and the date and time.

Lopez Moreno also says temporary retention for client handovers, knowledge transfer or pending audits should have a stated justification and an end point. His conclusion places organisational needs alongside former employees’ privacy rights, rather than treating business ownership of a system as sufficient reason for unrestricted access.

What happens next

The article sets out recommendations for organisations to implement; it does not announce a regulatory deadline or enforcement programme. Its proposed approach requires employers to turn the guidance into procedures suited to their records, operations and jurisdiction.

For documents stored on a departing employee’s computer, it recommends transfer to a restricted, encrypted folder or dedicated repository. Searches of these files should follow a predefined, documented list of keywords, rather than allowing broad access to the collection.

Once necessary information has been extracted, the associated devices can be prepared for reuse. The article calls for secure deletion and a complete wipe before equipment is reassigned.

Its retention table also identifies non-work personal files as a separate category for deletion, saying there is no basis for keeping them after employment ends. Examples include private photographs, identity-document scans and personal banking records; these should not simply be treated as ordinary business archives.

Establishing retention schedules requires an assessment of legal duties, operational requirements and privacy risks. The article recommends examining those factors together rather than applying the longest available retention period to every category of information.

Responsibility also extends beyond the IT team performing technical tasks. Earlier CISA guidance on insider threat management teams recommends involving security, HR, legal and operational specialists, with safeguards for sensitive employee information—a relevant organisational framework for decisions about departed staff members’ records.