Biggest question for me would be why the employee still had access so long after terminating employment with Cisco.

A common piece of auditor evidence across many compliance frameworks is whether employees have access proportionate to their role (which is naturally highly subjective), but also proving that access is revoked when employees leave the company. This seems like an outright failure on Cisco’s part.

Hopefully they’ve learned from this and put effort into enhancing their identity governance situation.