Secure employee termination | Fluid Attacks Help

Secure employee termination

This document details the protocol Fluid Attacks follows each time a talent leaves the company.

High-level process

  1. The administrative team preps termination paperwork for cases in which it applies (letter of dismissal, reports, inventory list, among others).
  2. Terminated employees are dismissed in OKTA, Time Doctor, Google Suite, EasyLlama, and applications based on the role, to remove the logical access.
  3. Communicate to relevant stakeholders and identify hand-off plans for cases in which it applies.
  4. Return hardware and sanitize as needed.
  5. Wrap up financial items.

Logical access to systems

The Administrative Director requests the deactivation of corporate systems through the Help channel. Based on the role, the Head of Service or the Security Manager should deactivate some other access. The following are systems to which access is revoked:
  1. Okta
  2. Google Suite
  3. EasyLlama
  4. Time Doctor
  5. JAMF (if applies)
  6. Other tools/systems depending on the role

Physical access

The Administrative Director request the laptop access deactivation.

Hardware return

The administrative team collects the hardware assigned to the talent:
  1. Laptop
  2. Keyboard, mouse and any other devices assigned by Fluid Attacks (if applies)

Exit reminder

As part of the offboarding process, Fluid Attacks sends leaving employees an email on their last day to remind them of their security commitments following their departure, which were agreed to in a non-disclosure agreement. This message is sent to their personal email address, as their Fluid Attacks account is deactivated. The reminder text contains a statement along the lines of the following:
“You will remain bound by the confidentiality agreement (NDA) you signed previously during the onboarding process, which includes:
  1. Maintaining the confidentiality of all of Fluid Attacks' proprietary information
  2. Not disclosing any customer data or sensitive information acquired during your employment
  3. Not retaining any company documents or data, whether in physical or electronic form”