Certified Incident Handler (CIH) Practice Ecam

What should be the next immediate step taken by an organization when an employee is terminated?

1. Inform remaining staff

2. All access rights should be disabled

3. Conduct an exit interview

4. Transfer responsibilities to another employee

The correct answer is: All access rights should be disabled

Disabling all access rights immediately upon an employee's termination is a critical step in ensuring the security and integrity of organizational data and resources. This action serves as a preventative measure to protect sensitive information from unauthorized access. When an employee is terminated, they should no longer have the ability to access company databases, files, or any systems that could potentially lead to data breaches or misuse of information. This step is aligned with best practices in incident response and information security. It ensures that terminated employees cannot use their credentials to access company resources, mitigating the risk of sabotage, data theft, or leakage of sensitive information. While informing remaining staff, conducting exit interviews, and transferring responsibilities are important processes in managing workforce changes, these are secondary steps that should occur after securing access rights. The priority must be the protection of organizational assets and information, making the immediate disabling of access rights essential.