The company should implement a certificate revocation list, or CRL. Smart-card authentication commonly relies on certificates issued to users. When employees leave, their certificates must be revoked so those credentials can no longer be trusted. A CRL is published by a certificate authority and lists certificates that should no longer be accepted before their normal expiration date. A CA issues and manages certificates, but the specific missing control is revocation checking. A TPM stores cryptographic material on a device and does not revoke user certificates. A CSR is used to request a certificate, not disable one. An HSM protects cryptographic keys, but it does not prevent former employees from using still-valid smart-card certificates.

================