Does Ticket Closure Prove Access Removal?

Research question: How often does a closed removal ticket agree with direct evidence for named accounts, delegated access, active sessions, tokens, shared assets, and administrator ownership?

Method: Create twenty-five synthetic offboarding inventories across common system categories. Seed closed tickets with incomplete removal, open tickets with completed action, orphaned shared assets, stale sessions, and verified controls. Two reviewers compare ticket-only and direct-check conditions.

Unit and measures: The unit is one access path in one inventory. Report confirmed removal, unresolved state, false closure, orphaned ownership, reviewer agreement, and time to verification by access type.

Scope and limitations: Simulated records do not test a live vendor, technical exploit, insider behavior, legal hold, or every form of cached access. A direct check is evidence at a point in time and cannot prove that no undiscovered account exists.

Use: Security and system owners may use the pattern to define closure evidence. The coordinator can maintain the inventory, while authorized owners decide removal timing, exceptions, data retention, and incident response.

Sources consulted: NIST Cybersecurity Framework 2.0 (https://www.nist.gov/cyberframework); CISA Identity and Access Management guidance (https://www.cisa.gov/topics/cyber-threats-and-advisories/identity-and-access-management); U.S. Government Accountability Office, Standards for Internal Control in the Federal Government (https://www.gao.gov/products/gao-14-704g); Google Search Central, Article structured data (https://developers.google.com/search/docs/appearance/structured-data/article); Sitemaps protocol (https://www.sitemaps.org/protocol.html). These public sources provide general control and publishing concepts. They do not measure Outsourced Employment, establish employment or legal obligations, guarantee indexing, or certify any workflow.