Joiners, movers and leavers (JML)
Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave. Cyber Essentials asks about each stage: approving new accounts (A7.1), matching access to the current job (A7.4) and deleting or disabling leavers' accounts (A7.3).
- Term
- Joiners, movers and leavers
- Also known as
- JML, Starters and leavers process, Onboarding and offboarding
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term joiners, movers and leavers mean in Cyber Essentials?
Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave.
How does joiners, movers and leavers apply to Cyber Essentials?
In plain terms
It is the IT version of handing out, swapping and collecting office keys. A new starter gets the keys for their job. Someone who moves teams hands back the old keys and gets new ones. A leaver returns every key on their last day, not three months later.
What Cyber Essentials asks
The user access control section of the NCSC requirements covers all three stages. Your organisation must:
- "have in place a process to create and approve user accounts"
- "remove or disable user accounts when they're no longer required (for example, when a user leaves the organisation or after a defined period of account inactivity)"
- "remove or disable special access privileges when no longer required (when a member of staff changes role, for example)"
The question set turns these into written answers. A7.1 asks for your approval process, and the guidance says accounts should be approved by "a person with a leadership role in the business". A7.3 asks how you make sure leavers' accounts are deleted or disabled: "When an individual leaves your organisation, you need to stop them accessing any of your systems." A7.4 covers movers, and A7.9 asks whether admin access is reviewed regularly.
What an assessor looks for
A process someone could follow, not a promise. Name who raises the request, who approves it and who removes access. Make sure it reaches cloud services, not only the office network, and accounts used by suppliers and contractors. A simple leaver checklist covering email, cloud apps, remote access and any shared passwords the person knew is a good way to show it.
See how quickly leavers' accounts must be removed and A7.3. Related: user account, least privilege, privileged access.
Related terms
- User accountA user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service.
- Least privilegeLeast privilege is the rule that each person gets only the access they need to do their current job, and nothing more.
- Privileged accessPrivileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- PasskeyA passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN.
- PassphraseA passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember.
Frequently asked questions
Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave.
In the 2026 Danzell question set, joiners, movers and leavers comes up at A7.1, A7.3, A7.4, A7.9. Read those questions against the definition above so your answers use the term the way the assessor will.
Joiners, movers and leavers relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.