questionnaire asks if accounts of departed employees are blocked

Deprovisioning of accounts upon termination of employment

Yes, this is a standard question within access management, and usually the answer is "yes" if there is a fixed procedure in place for revoking accounts upon termination of employment. The question tests not only whether it happens, but also how quickly: immediately on the last working day, or only at the next payroll run. Customers who ask detailed questions sometimes want to see an indication of the turnaround time, for example in an SLA or work instruction.

If there is no automated link between HR termination and the IT environment, "yes" is still often defensible, provided that there is a manual checklist that someone with the appropriate function actually works through. If both the link and the checklist are missing, then "no" is the honest answer, even if things usually go well in practice — a questionnaire asks about the process, not about the good intentions of the administrator. This topic is closely related to the establishment of access policies and management of business assets, and to the question of whether use of multi-factor authentication is separately tested — accounts that have not been revoked but are protected with MFA weigh differently in practice than completely unprotected accounts.

Where this falls under in Article 21(2)

Deprovisioning falls under the access control and business asset management measures in Article 21(2) of the NIS2 Directive (2022/2555), and reappears in Annex A of ISO/IEC 27001 in the control measures around termination or change of employment. For entities that will fall under the Cybersecurity Act, the same principle applies once that act enters into force on 15 August 2026; until that date the directive itself is not yet directly binding on Dutch businesses, but many customer questionnaires are already running ahead of the text.