Employee termination

This document details the protocol Fluid Attacks follows each time a talent leaves the company.

High-level process

The administrative team prepares termination paperwork for cases in which it applies (letter of dismissal, reports, inventory list, among others).
Terminated employees are dismissed in OKTA, Time Doctor, Google Suite, EasyLlama, and applications based on the role, to remove logical access.
Communicate with relevant stakeholders and identify hand-off plans for cases in which it applies.
Return hardware and sanitize as needed.
Wrap up financial items.

Logical access to systems

The Administrative Director requests the deactivation of corporate systems through the Help channel. Based on the role, the Head of Service or the Security Manager should deactivate some other access. The following are systems to which access is revoked:

Okta
Google Suite
EasyLlama
Time Doctor
JAMF (if applies)
Other tools/systems, depending on the role

Physical access

The Administrative Director requests the laptop access deactivation.

Hardware return

The administrative team collects the hardware assigned to the talent:

Laptop
Keyboard, mouse and any other devices assigned by Fluid Attacks (if applies)

Exit reminder

As part of the offboarding process, Fluid Attacks sends leaving employees an email on their last day to remind them of their security commitments following their departure, which were agreed to in a non-disclosure agreement . This message is sent to their personal email address, as their Fluid Attacks account is deactivated. The reminder text contains a statement along the lines of the following:

“You will remain bound by the confidentiality agreement (NDA) you signed previously during the onboarding process, which includes:

Maintaining the confidentiality of all of Fluid Attacks’ proprietary information
Not disclosing any customer data or sensitive information acquired during your employment
Not retaining any company documents or data, whether in physical or electronic form”