Description:
This control ensures that user accounts belonging to departed employees, contractors, or other personnel are promptly removed from the Zoho organization when access is no longer required. Timely removal of departed user accounts helps prevent unauthorized access to organizational resources and reduces security risks associated with orphaned accounts.
Rationale:
Departed user accounts may retain access to organizational data, applications, and services if not removed promptly. Removing these accounts reduces the risk of unauthorized access, supports effective user lifecycle management, and helps maintain an accurate inventory of active users.
Impact:
Reduces the risk of unauthorized access by former personnel.
Improves user lifecycle management and account governance.
Supports compliance requirements related to access control and user management.
Ensures only authorized users retain access to organizational resources.
May require coordination with human resources and management teams during offboarding.
Default Value:
Not enforced by default. Administrators must manually deactivate or delete user accounts as part of the organization's offboarding process.
Remediation
Test Plan
Sign in to the Zoho Admin Console with administrative privileges.
Navigate to Directory → Users.
Review the list of user accounts.
Identify users who have departed the organization.
Verify that departed user accounts have been deactivated or deleted according to organizational policy.
Review recently deleted users, if applicable.
Verify that departed users no longer have access to Zoho services.
If departed user accounts remain active, follow the Implementation Plan to remediate the issue and repeat the test.
Implementation Steps:
Sign in to the Zoho Admin Console with administrative privileges.
Navigate to Directory → Users.
Identify the user account belonging to the departed employee or contractor.
Deactivate the user account immediately to prevent further access.
Review ownership of files, applications, and organizational resources associated with the account.
Transfer ownership of organizational data and resources to an authorized user, if required.
Remove the user from groups, roles, and application assignments.
Delete the user account according to organizational offboarding procedures.
Confirm the deletion of the user account.
Verify that the departed user no longer has access to Zoho services.
Backout Plan:
Sign in to the Zoho Admin Console with administrative privileges.
Navigate to Directory → Users.
Locate the deleted or deactivated user account.
Restore or reactivate the user account, if available and required.
Reassign groups, roles, and application permissions as necessary.
Verify that the restored user account functions according to organizational requirements.
References: