Why it matters
The highest-risk moment for an employee is often the day they leave, not while they're working for you.
How a self-led small team implements it
Pair this directly with A.5.11 (return of assets) in one offboarding checklist — access revocation and asset return, same list.
What auditors expect to see
Offboarding checklist including access revocation.
Track A.6.5 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS