Security

Employee Offboarding: The IT Checklist That Protects Your Business

Most businesses run tight hiring paperwork and casual departures — and it's departures that create the risk. Former-employee access is one of the most common, most preventable security gaps we find. Here's the checklist, in the order it should happen.

Same hour as the departure

• Disable sign-in on the master account (email/identity) — this cascades to most cloud apps. Disable, don't delete: you'll need the mailbox and files.
• Revoke remote access: VPN, remote desktop, any portal reachable from home.
• Deactivate door credentials: fobs, cards, codes, and mobile passes. If you're on shared door codes, change them — then upgrade to per-person credentials so departures never mean re-keying again.
• Collect devices: laptop, phone, keys, and that access badge in the truck.

Same day

• Phone system: reroute their extension and direct number, update ring groups and the auto attendant, set a professional voicemail handoff, and unassign their softphone/mobile app.
• Email continuity: forward or delegate the mailbox to a manager; set an auto-reply naming the new contact.
• Shared passwords they knew: WiFi, alarm codes, vendor logins, social accounts — rotate them. (A password manager turns this from an afternoon into ten minutes.)
• Their personal cloud accounts attached to business systems — the domain registrar registered to a personal email is a classic time bomb. Reassign ownership now.

Same week

• Transfer file ownership and archive the mailbox per your retention policy.
• Remove them from vendor authorization lists (ISP, carrier, bank, alarm company).
• Wipe and reimage returned devices before reassignment.

Make it a form, not a memory

The difference between businesses that leak access and ones that don't is a checklist owned by someone specific. We build offboarding runbooks for clients as part of managed support — and our security assessments almost always find at least one ghost account. Ask us to look for yours.