Essentials
£249/mo
or £199/mo billed annually
compliance, plus automation
Start free →Joiners, Movers & Leavers
Prove the leaver lost access — don't just say so
Every framework asks whether a departing employee's access was removed, and how fast. Almost nobody can answer on demand. 786 Cyber records the leaver, builds the checklist from the devices and controls they actually held, and then watches your directory to confirm the account really went disabled — measured against your SLA, ready to attach to the answer.
786 Cyber does not revoke access
It proves you did. Your administrator disables the account in Microsoft 365 or Google Workspace as they always have — we never ask for permission to change anything in your tenant. What we do is watch: the next directory sync observes the account disabled, records the moment it happened, and measures it against the window your policy sets.
That is a stronger position than acting on your behalf would be. A vendor asserting "we disabled it" is a claim about itself. An observation of your identity provider's actual state is evidence about your organisation — which is what the auditor asked for.
What it does
A checklist built from your own records
Not a template you fill in. One line per device assigned to them, one per compliance control they own — because a leaver who owns controls otherwise leaves them owned by someone who no longer works for you — plus platform access and mailbox transfer.
An SLA clock that means something
24 hours by default, 48 if your policy says so, immediate for an involuntary termination. Those are the only options, because an SLA you can set to anything is not an SLA — and the frameworks asking for this name the 24–48 hour window specifically.
The item you cannot tick
"Disable the directory account" has no tickbox at all. It ticks when your next Microsoft 365 or Google Workspace sync observes the account genuinely disabled. A box you can tick by hand is a claim; this is evidence, so it does not offer one.
Leavers nobody told you about
A daily sweep runs whether or not anyone presses Sync, flagging accounts observed disabled with no leaver on record, people gone from the directory, and accounts dormant past 90 days. Each is a suggestion for a human to confirm — never an automatic offboarding.
A report that attaches to the answer
Per leaver: last working day, when revocation was observed, hours elapsed against your SLA, and how it was confirmed. Save it to your evidence vault and attach it to the assessment answer it satisfies.
Read-only, always
We ask for read-only directory access and nothing more. No permission to disable accounts, revoke sessions or touch mailboxes in your tenant — which is usually the difference between an integration your IT team approves and one they refuse.
How it works
Start a leaver on someone's record with their last working day, and 786 Cyber generates the checklist from what it already holds about them — their assigned devices, the compliance controls they own, their platform access. Your admin disables the directory account as usual. The next sync, or the daily sweep that runs regardless, observes that the account has gone and stamps the revocation with the time it was seen.
From there the leaver evidence report writes itself: last working day, observed revocation, hours elapsed, how it was confirmed, and how much of the checklist was completed by whom. Save it to your evidence vault and it becomes an item you can attach to the assessment answer it satisfies — which is what turns a workflow into compliance evidence rather than an internal to-do list.
Why 786 Cyber
Observed, not asserted. We watch your identity provider and record what it actually did.
No write access to your tenant. Read-only scopes. Your admin still disables the account.
Percentages that cannot flatter. Within-SLA is measured over revocations we can evidence, never over all leavers.
Evidence where the auditor asks. Attach the report to the assessment answer, not to an email thread.
What it doesn't do
It doesn't act in your tenant. No disabling accounts, revoking sessions or reassigning mailboxes — by design, as above.
A mover prompts a review; it doesn't perform one. We cannot see entitlements, so we cannot tell you what someone's access change actually meant. The step records the change and asks you to review it.
There's no HR-system integration. Leaver events start from you, or from a signal we detected in your directory — not from Workday or BambooHR.
Frequently asked questions
Does 786 Cyber disable the account for me?
No — and that is deliberate. Your administrator disables the account in Microsoft 365 or Google Workspace exactly as they do today; 786 Cyber observes the next directory sync and records when access genuinely went away. It means we need only read-only access to your directory, and it means the evidence is an observation of your identity provider rather than a vendor asserting its own action. Write-back is a future option, not a missing piece we are working around.
What counts as evidence that access was revoked?
A directory sync observing the account disabled. That observation carries the timestamp, and the time-to-revocation is measured from the last working day you recorded. You can also attest when access was revoked — useful when you know the exact time, or your directory is not synced — but it is kept as a second record beside the observation, never merged into it and never counted toward the SLA result. The directory then checks it: a later sync that sees the account disabled corroborates it; one that still sees it enabled after the time you gave contradicts it, and the report says so.
How is the within-SLA percentage calculated?
Over the revocations we can actually evidence — not over every leaver you recorded. Counting the unconfirmed ones would let unknowns quietly register as passes, which is exactly the kind of flattering number that falls apart under audit. Leavers still awaiting confirmation are reported separately as awaiting revocation.
Will it offboard someone automatically?
Never. When a sync spots an account that looks like an unrecorded leaver, it raises a suggestion — nobody is offboarded, no status changes and no SLA clock starts. Confirming it asks you for the last working day, because a sync cannot know it, and that confirmation is what creates the event. Dismissing it closes the matter unless a stronger signal appears later.
Does the mover step review access?
No. It records the role, department or manager change and prompts you to review that person’s access in your identity provider. 786 Cyber cannot see entitlements — group memberships, role assignments, privileges — so it cannot tell you what changed, and it does not pretend to. The step is a prompt and is labelled as one.
Which frameworks does this evidence?
The access-management controls that ask for a documented joiner/mover/leaver process and recent proof of timely revocation — NCA ECC 1-9, SAMA CSF, ISO 27001 A.5.18, and the user-account controls in Cyber Essentials. Several of them specify the 24–48 hour window the SLA is built around.
Why read-only is the design, not a limitation: we deliberately built the button that doesn't exist. See the wider picture in the Environment & People pillar.
Start a 14-day free trial
No card required. Connect a directory and see the accounts nobody closed.