pburkholder commented 2 years ago

Platform Operator Offboarding Checklist

Special Notes

Do not create this issue until the System Owner has formally authorized and requested it.
Authorized at: https://groups.google.com/a/gsa.gov/g/cloud-gov-compliance/c/TWM_IZ0dX6s by Ashley Mahan
Please only use first names.

Instructions

In order to complete Existing Person's exit from the cloud.gov team, the assignee should complete a prescribed set of tasks that will remove any special access.

Assignee: The tasks below are organized by the role needed to complete them. If you can’t complete any of the items on your checklist personally, you are responsible for ensuring that an appropriate person does it.

For compliance we need to show that critical offboarding actions happen within 24 hours of departure; some actions below need GitHub issues comments when completed. Completing tasks before departure is good. (control PS-4: personnel termination).

`Existing Person`

[ ] Initiate the process via the Leaving TTS Handbook page

Assignee

If the person offboarding is a contractor follow the steps in the offboarding checklistt in addition to the following steps below.

[ ] Mention the TTS HR liaison and TTS Tech Portfolio in this ticket so they can update with their status
- As part of TTS offboarding, TTS Tech Portfolio will automatically:
- [ ] Remove their access to StatusPage
- [x] Remove them from the cloudgov subteam in Docker Hub
- [x] Remove write/push access for NPM from cloudgov-style
- [ ] Remove them from HackerOne
- [ ] If they are leaving GSA, ask #admins-slack to convert them to a single-channel alumni user
- [x] Remove their agent access to Zendesk - switch their role to "end user"
- Update this issue with a comment within 24h of departure that the above steps are complete
[x] Remove them from @cg-team, @cg-operators, and any other @cg- teams in the Slack Team Directory using the three-dot menu (instructions)
[x] Remove them from the team roster
[x] Remove them from the squad list
[x] In the training tracker: if they're staying at TTS, move them to the "former teammates" tab; if they're leaving TTS, delete them from the spreadsheet
[ ] Remove them as invitees for any meetings on the cloud.gov calendar where they are specifically named
- Invites where they are listed as part of the cloud.gov invitee group will be removed when they are removed from that group by the System Owner
[x] Remove them from our dockerhub org

System Owner (or person delegated by System Owner)

The following steps must be conducted and documented within 24 hours of departure:

[ ] Exit interview with supervisor or contract account manager: Discuss with departee the following information security topics:
- They are to remove any non-public cloud.gov data (e.g. keys, passwords, code, documents) from any non-GSA device
- They are not to disclose any non-public cloud.gov technical practices without authorization from GSA
- They will not access cloud.gov systems or services without authorization from GSA
- If the System Owner cannot hold this discussion, they will communicate to GSA OHRM that the above topics need to be communicated to the leaving person.
[x] Remove them from the cloud.gov Github organization
[x] Remove them from the cloud.gov team Google Group
[ ] If they are part of the business unit, remove their access to GovDelivery

The following do not directly impact cloud.gov security & operations and can happen later:

[x] Remove them from Nessus
[ ] Remove them from [Tenable (if Compliance Team)](https://community.tenable.com/s/contacts]
[x] Remove them from the Cloud Foundry Community GitHub org cloud.gov team
[ ] Remove them from the CG-PRIV Google Group
[x] Remove them from the cloud.gov operations Google Group
[ ] Remove them from the cloud.gov compliance team Google Group
[x] Remove them from the cloud.gov notifications Google Group
[ ] Remove them from the cloud.gov inquiries Google Group
[ ] Remove them from the cloud.gov support Google Group
[ ] Remove them from the cloud.gov emergency Google Group
[ ] Remove them from our Google Groups for our AWS accounts (relevant for PM, Director, and Deputy Director)
[x] Remove them from Search.gov access for cg-site by pinging the search.gov team in the #search Slack channel

Cloud Operations

The following steps must be conducted and documented within 24 hours of departure:

[ ] Delete the user in all cloud.gov AWS accounts. There should be info on which AWS accounts you need to look at here
[x] Remove their access as an admin on the platform
[x] Remove any privileges that their cloud.gov account has due to membership in the cloud.gov team (even if not in Cloud Ops), such as admin_ui.user and scim.read
- [x] Verify these permissions have been removed using the cg-scripts validate-admins.sh run from a jumpbox
[x] Remove any Org or Space roles that their cloud.gov account holds due to membership in the cloud.gov team (for example, remove them from the cloud-gov and cloud-gov-operators organizations)
[ ] Ensure any keys or passwords they had direct access to are rotated
[x] Remove their PGP public key file (if any) from the cg-pgp-keys bucket