Joiner-Mover-Leaver Procedure Template

A step-by-step joiner, mover and leaver procedure with a fill-in SLA table, the evidence auditors sample for each event, and the control each step maps to in NIST SP 800-53 (AC-2, PS-4, PS-5) and ISO/IEC 27001:2022.

A joiner-mover-leaver (JML) procedure is the documented sequence that creates access when someone starts, changes it when they move role, and removes it when they leave, with a time limit for each step and a record that proves it happened. Auditors test JML by sampling: they pick leavers from the HR system and check when each one lost access in each system. This template gives you the steps, an SLA table to fill, and the evidence to keep so the sample passes.

How to use this template

Confirm the trigger: every JML event should start from the HR system of record (or the contractor sponsor's request), not from an email to IT.
Fill the SLA table (section 2). The bracketed values are suggested starting points used by many teams; they are planning estimates, not requirements from any standard. NIST AC-2 and PS-4 ask you to define the time periods; they do not set them.
List every system that is not connected to automated provisioning in section 6. Those are the ones that fail audits.
Adopt it under your IAM policy, section 4.2.

Background: joiner-mover-leaver, user lifecycle management guide, SCIM provisioning recipe.

Owner: [Identity team] | HR contact: [ ] | Approved: [date]

1. Triggers and sources

Event	Source of truth	Trigger	Who is notified
Joiner (employee)	`[HRIS]`	Hire record reaches `[status]`	Manager, identity team
Joiner (contractor)	`[Sponsor request / VMS]`	Approved request with end date	Sponsor, identity team
Mover	`[HRIS]`	Change of department, manager, job code or location	Old and new manager
Leaver (voluntary)	`[HRIS]`	Termination date entered	Manager, identity team
Leaver (involuntary)	`[HR business partner]`	Direct notice to identity team before the conversation	Identity team on-call, security
Contractor end	`[Sponsor / VMS]`	End date reached or sponsor ends engagement	Sponsor

(NIST AC-2(l) Align account management processes with personnel termination and transfer processes; AC-2(h) notify account managers when users are terminated or transferred)

2. SLA table

Event	Step	SLA	Measured from	Measured to
Joiner	Birthright access ready	`[Before start date]`	HR record created	First successful sign-in possible
Joiner	Additional access	`[2 business days]`	Approved request	Access granted
Mover	New role access	`[1 business day]`	HR change effective	New birthright applied
Mover	Old role access removed	`[5 business days]`	HR change effective	Old entitlements removed and verified
Leaver (standard)	Disable IdP account and end sessions	`[End of last working day]`	Termination time	Account disabled, sessions revoked
Leaver (standard)	Remove access in non-federated systems	`[24 hours]`	Termination time	Confirmed by system owner
Leaver (involuntary or privileged)	Disable all access	`[Immediately, before or during notification]`	HR notice	Account disabled, sessions and tokens revoked
Contractor end	Disable all access	`[At end date, automatic]`	End date	Account disabled
Any	Inactive account disabled	`[__ days]` without sign-in	Last sign-in	Account disabled

(NIST PS-4(a) disable system access within an organization-defined period; PS-5 initiate and complete transfer actions within defined periods; AC-2(3) Disable Accounts)

3. Joiner procedure

HR record created with job code, department, manager, location and start date.
IdP account created automatically from the HR record. Unique identifier assigned and never reused. (NIST IA-4 Identifier Management)
Birthright groups assigned from the role catalog for the job code.
Downstream accounts created by SCIM or JIT provisioning from the IdP.
Enrollment credential issued (for example a temporary access pass) only after identity is verified, following the MFA standard.
User registers phishing-resistant MFA on day one.
Any access beyond birthright is requested and approved by the system owner. (NIST AC-2(e) approvals for account creation)
Contractor accounts are created with an end date and a sponsor (third-party access policy).

4. Mover procedure

HR change triggers recalculation of birthright groups.
New birthright access is added.
Old manager and new manager are asked to confirm which non-birthright access the person still needs. Default is removal.
Access not confirmed is removed within the SLA and the removal verified in the target system. (NIST PS-5(a), PS-5(c); ISO 5.18 Access rights)
Privileged access is re-approved, never carried over automatically.
Ownership of service accounts and other NHIs held by the person is confirmed or reassigned.

Guidance: movers are where entitlements pile up. An access review that never revokes anything usually means mover cleanup is not happening; see mover entitlement accumulation.

5. Leaver procedure

Use the secure offboarding checklist for the full leaver run.

Guidance: disabling SSO does not end a session or a token that already exists. At CrowdSec, a former employee's GitHub account was left open to finish work and its valid token was used to copy private repositories. At Cash App Investing, a former employee downloaded customer reports after leaving. See orphaned account abuse.

6. Systems outside automated provisioning

System	Owner	How access is removed	Who confirms	SLA
`[ ]`	`[ ]`	`[manual ticket / script]`	`[ ]`	`[ ]`

7. Evidence to keep

Event	Evidence	Where it lives	Retention
Joiner	HR record, access request with approver and timestamp, provisioning log	`[ ]`	`[__ years]`
Mover	HR change record, manager confirmations, removal log with timestamps, verification that old access is gone	`[ ]`	`[__ years]`
Leaver	HR termination timestamp, IdP disable timestamp, session revocation log, per-system confirmation for non-federated apps, device return record	`[ ]`	`[__ years]`
Exceptions	Late removals with reason and approver	`[ ]`	`[__ years]`
Metrics	Monthly SLA report	`[ ]`	`[__ years]`

Guidance: the auditor's question for each sampled leaver is "termination time vs. disable time, per system". Keep both timestamps in UTC in one place and the sample takes minutes instead of days.

8. Metrics

Metric	Target	Last month
Leavers disabled within SLA	100%	`[ ]`
Median time from termination to IdP disable	`[ ]`	`[ ]`
Movers with old access removed within SLA	`[ ]%`	`[ ]`
Active accounts with no matching HR record	0	`[ ]`
Accounts disabled for inactivity	`[ ]`	`[ ]`

Control mapping

Step	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
Triggers	AC-2(h), AC-2(l)	5.16 Identity management
Joiner	AC-2(e), IA-4	5.16; 5.18 Access rights
Mover	PS-5 Personnel Transfer	5.18; 6.5 Responsibilities after termination or change of employment
Leaver	PS-4 Personnel Termination; AC-2(k)	5.18; 6.5; 5.11 Return of assets
Inactivity	AC-2(3) Disable Accounts	5.18
Third parties	PS-7 External Personnel Security	5.19 Information security in supplier relationships

Control text: NIST SP 800-53 Rev. 5 catalog. ISO/IEC 27001:2022 is available from ISO.

Access review checklist
What is IGA and how to choose an IGA platform
Deprovisioning and orphaned account
SOC 2 for identity (CC6.2 is the joiner and leaver criterion)