the questionnaire asks how we revoke access when an employee leaves

Deprovisioning is part of access policy, not HR process

The questionnaire wants to know here whether revoking access upon termination of employment is a fixed, documented process — not an ad-hoc action that depends on whether the manager passes it on to IT. Concretely, the assessment usually covers: is access revoked on the last working day (or earlier), does that happen for all systems including shared accounts and cloud applications, and is there a checklist or automated trigger that ensures this. This falls under access control and management of business assets, and many customers ask about it specifically as a separate part of that question, not as a separate question.

If there is no formal process, but access in practice is always revoked, "no" with an explanation is more honest than a "yes" without evidence. Evidence that often suffices here: a process description or checklist from the identity and access management system, an export of account statuses after termination of employment, or a reference to the HR offboarding process in which the IT step is included. If that evidence is missing, the answer for now is "no" — that is not a rejection of the questionnaire, it is a gap that becomes visible and that you can close outside of this list. Also check whether multi-factor authentication plays a role in the answer: some customers specifically ask whether MFA tokens and hardware keys are also recovered, which requires different evidence than just revoking an account; check that with multi-factor authentication for business systems.

Where this falls under the ten measures

Access policy, including revoking access upon termination of employment, falls under the measures for access control and personnel security mentioned in Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555). Those working with ISO/IEC 27001 will recognise this as a control measure from Annex A on access management and termination of employment; an auditor will usually specifically ask for evidence of the last termination, not just policy on paper.