In relevant security tooling (such as a SIEM or EDR), a watchlist (also known as a reference set) should be used to monitor for any activity generated by accounts belonging to employees who have left the organization, as this is unexpected. This can help to ensure that the security team readily detects any unrevoked access or account usage.

This process must be in partnership with the Human Resources team, which should inform the security team when an individual leaves the organization (during an Employee Off-Boarding Process, see PV024), including their full and user account names. Ideally, this process should be automated to prevent any gaps in monitoring between the information being sent and the security team adding the name(s) to the watchlist. All format variations should be considered as individual entries in the watchlist to ensure accounts using different naming conventions will generate alerts, such as john.smith, john smith, john.smith@company.com, and jsmith.

False positives could occur if there is a legitimate reason for interaction with the account(s), such as actions conducted by IT staff.

Sections

ID	Name	Description
MT003	Leaver	A subject leaving the organisation with access to sensitive data with the intent to access and exfiltrate sensitive data or otherwise contravene internal policies.
IF015	Theft	A subject steals an item or items belonging to an organization, such as a corporate laptop or corporate mobile phone.
IF015.001	Theft of a Corporate Laptop	A subject steals a corporate laptop belonging to an organization.