Test offboarding evidence by mapping the person to the accounts

A disabled-account screenshot does not establish that every account belonging to a departed person was disabled within the required period. First connect the person, accounts, relevant events and the exact control criterion.

This original fictional exercise is for career preparation. All identifiers, people and systems are invented. Do not put real employee records, access logs or organizational account inventories into a public portfolio.

Define the population before reading the timestamp

The fictional organization's rule requires the two assigned Atlas console accounts to have sign-in disabled within two hours of the effective departure time. This is a teaching criterion, not a universal deadline. Session revocation, other applications and physical access are outside this narrow test and require separate evidence.

NIST SP 800-53 Rev. 5, PS-4 addresses disabling system access within an organization-defined period and revoking associated credentials. It does not supply this exercise's two-hour limit. A narrow sign-in test alone does not establish that the broader control is satisfied.

The mapping uses stable person and account identifiers. A display name alone could match the wrong person or omit a second account. Here M8 explicitly supplies two accounts; in a real assessment, you would also evaluate whether the account inventory and mapping are complete for the defined scope.

Reach a conclusion for each account

For A101, 12:00 to 14:15 is 135 minutes. The supplied two-hour criterion allows 120 minutes, so this event is 15 minutes late. Starting at notification would yield 45 minutes, but notification is not the criterion's starting event.

For A209, current disabled state does not establish the disable time. Classify timeliness as unresolved and request the relevant change event or other reliable time evidence. Do not mark it on time because its current state is correct, or late because the packet is incomplete.

One late account and one unresolved account do not become a clean offboarding result when combined. Nor does this two-account exercise establish an exception rate for the whole organization.

Write the limited finding

Try: “For departure D17, mapping M8 identifies two in-scope Atlas accounts. L6 supports A101 sign-in disablement 135 minutes after the effective departure, exceeding the fictional criterion by 15 minutes. S2 supports A209's later disabled state but not its timing. Request the A209 change event and confirm mapping completeness. Session and other-system access remain untested.”

Keep a separate column for each account's mapping source, event source, timing result and missing evidence. Compare offboarding preparation resources for broader response practice. The privileged-access review exercise addresses periodic business need, a different test from departure disablement.