8.2.5User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycle

Defined Approach Requirements:

Access for terminated users is immediately revoked.

Defined Approach Testing Procedures:

8.2.5.a Examine information sources for terminated users and review current user access lists—for both local and remote access—to verify that terminated user IDs have been deactivated or removed from the access lists.

8.2.5.b Interview responsible personnel to verify that all physical authentication factors—such as, smart cards, tokens, etc.—have been returned or deactivated for terminated users.