We deliberately built the button that doesn't exist

Why we built it this way

The obvious feature to build here is a button that disables the leaver's account for you. We chose not to — not because we haven't got round to it, but because the version that reaches into your identity provider and flips a switch answers the wrong question.

Compliance frameworks ask for evidence that a leaver's access was revoked within a defined window. They don't ask for the vendor to be the one who revoked it. Those sound like the same requirement. They aren't — and the difference is who your IT admin has to trust.

A tool that writes to your directory needs write access to it: broad scopes that show up in a security review as a standing risk, whether or not they're ever misused. A tool that only observes your directory needs none of that. 786 Cyber asks for read-only scopes. We don't hold the permission to disable an account even if we wanted to — so a misconfigured or compromised integration can't disable, create or change one either.

What it looks like in practice

When someone leaves, you record their last working day and 786 Cyber builds the checklist from what it already holds about them — one line per device assigned to them, one per compliance control they own, plus platform access and mailbox transfer. An SLA clock starts: 24 hours by default, 48 if your policy says so, immediate for an involuntary termination. Those are the only options, because an SLA you can set to anything isn't an SLA.

Your admin disables the account the way they already do. Then 786 Cyber watches. A directory sweep runs every day whether or not anyone clicks Sync — 05:00 London for Microsoft 365, 05:30 for Google Workspace — and when a sync observes the account disabled, it stamps the revocation with the time it was seen and stops the clock. Not a checkbox: an observation of the system your business already runs on.

The same restraint applies to spotting leavers nobody recorded. An account disabled with no leaver on file, one gone from the directory, one dormant past 90 days — each raises a suggestion, and a person confirms it before any clock starts.

Observed, not attested

The distinction worth understanding is observed versus attested evidence. Attested means someone says it happened. Observed means a system recorded that it did. If a person can tick a box that says "done", sooner or later a box gets ticked before it's true — usually with the best intentions and the worst timing.

So in 786 Cyber the "disable the directory account" line has no tickbox at all. It ticks itself when a sync observes the account disabled. The leaver evidence report states on every row how each revocation was confirmed, and the within-SLA percentage is calculated over revocations actually recorded — never over every leaver — so a leaver still waiting on confirmation can't quietly count as a pass.

Where it shows up in your compliance answers

"Recent leaver evidence: account disabled within target SLA" is written into NCA ECC's joiner/mover/leaver control and Cyber Essentials' user-account controls; SAMA CSF expects a joiner/mover/leaver procedure with target SLAs; and the access-control sections most other frameworks share ask the same question in their own words. Save the leaver evidence report as an evidence item and attach it to each assessment answer it satisfies. The full workflow is on the leaver revocation evidence page.