This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook

For the CISO: Leavers and Account Findings

A one-page brief for the meeting that approves the pre-flight

A one-page brief for the CISO: why orphaned accounts come from the wiring and not from carelessness, how that connects to account-management findings, and the leaver measure that shows the before and after. Word download included.

One of four reader briefs that expand the pitches in Making the Case at Your Agency. Hand it over before the meeting, with The One-Page Ask.

Download	Use
Brief_for_the_CISO.docx	The brief below, one page, with your number to fill in

Design guidance

The pitch and the framing are this workbook’s design guidance. The facts come from the chapters under Go deeper, where each is footnoted to its primary source.

The brief

The point: an orphaned account isn’t an administrator’s mistake. It’s the guaranteed output of systems that share no event channel with HR, so sweeps remove a batch and the accounts come back. Fix the wiring, not the symptom.

One leaver, day by day

Day	What happens
−14	HR records the separation. No other system is listening.
0	The separation takes effect. The account, application logins and badge are still live.
+3	A ticket disables the directory account. Nine application accounts stay enabled.
+45	A review flags two of them. Nobody owns the other seven.
+180	A penetration test signs in with one. The gap is now an incident.

Why it reaches you

NIST SP 800-53 expects account management to align with personnel termination and transfer (AC-2 item l), and PS-5 covers transfers.
Access reviews stay as the check (AC-2 item j), but they sample state. They can’t observe a transition when it happens.

What changes

HR-driven identity gives those systems the event channel they’re missing.
When automation turns on, it turns on leaver first, because revocation is where the risk and the evidence value are.
The separation-to-block and separation-to-revocation intervals are measured from day one. That’s your before and after.

What we ask of you

Set the control requirements: MFA strength, the Conditional Access baseline and logging.
Say which assessment findings are priority one for Gate G0.
Support the four-week pre-flight, and agree the leaver measure.

Our number

Days for a leaver to lose access, from the HR record to the last account disabled: [days], from [count] separations

Go deeper

Topic	Chapter
The orphan timeline and the fragmented truth problem	Book 03, Chapter 02
Why this can’t be patched	Book 03, Chapter 02
Leaver first, in the HR-driven identity track’s Phase 4	Book 03, Chapter 12
Decision rights	Book 01, Chapter 09

Continue

← For the CIO · For the CHCO → · Start Here

Version and revision history

Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.

Versions of this guide, newest first
Version	Edition	Date	Changes
2.0	2026.11.5	2026-11-08	Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Meeting pack: The One-Page Ask, Charter Sign-Off Sheet and four reader briefs (#390); Approve 116 gated pages (Nov 7); fix RMF map stale-review test (#457); Release 2.0: Draft becomes Baseline (#491)