Employee Offboarding Checklist: How To Protect Your Systems From Ex-Employees

A former employee with a working login is one of the most common ways a small business is breached, and one of the least dramatic. Nobody hacks anything; someone who left in March still has the password to the CRM in June, or a contractor’s cloud console access was never revoked, or the departed bookkeeper’s mailbox is still receiving the bank’s messages. Most of these cases are careless rather than malicious, and all of them are prevented by a checklist that is run, in full, on the day. This is the checklist we use with clients, in order.

Before the last day

1. Agree the time. HR, the manager and IT agree when access ends: the end of the last day for a friendly departure, immediately for an involuntary one, before the meeting rather than after.
2. List everything the person can reach. Email, files, line-of-business applications, cloud consoles, banking and vendor portals, social media, the phone system, the alarm, the building. The list is easy if single sign-on and a password manager are in place, and painful if they are not, which is a reason to have them.
3. Decide where things go. Who receives the mail, who inherits the files, who takes over the customer accounts, who becomes the owner of any system the person administered.
4. Retrieve knowledge that lives only in their head. Passwords for anything not in the vault, vendor contacts, where the odd documents are. This is the last easy moment to ask.

On the last day

1. Disable the identity. In Microsoft 365 or Google Workspace, block sign-in, revoke every active session, and reset the password so cached credentials stop working. With single sign-on, this one step closes most doors at once.
2. Remove the second factor. The person’s phone stays their phone; it must stop being a key to anything of yours.
3. Handle the mailbox. Convert it to a shared mailbox for the manager, or forward it, for a set period. Remove it from distribution lists. Check for forwarding rules the person set up themselves; a rule that quietly forwards to a personal address is a common finding.
4. Transfer the files. OneDrive or Google Drive contents to the manager or a named colleague, and shared-drive ownership reassigned.
5. Remove access everywhere else. Every application on the list from step two, especially the ones outside single sign-on: accounting, payroll, the CRM, the dispatch or practice management system, cloud consoles, GitHub, the website, the domain registrar, social accounts, banking and vendor portals, and any shared logins whose password must now change.
6. Disable remote access. VPN accounts, remote desktop, and any always-on connection from a home computer.
7. Collect and wipe devices. Laptop, phone, tablet, hardware keys, badges and keys. Wipe managed devices remotely if they are not returned the same day; a managed laptop with disk encryption gives up nothing either way.
8. Change what they knew. The Wi-Fi password if it was shared, the alarm code, the door code, and any shared account they used.
9. Tell the people who need to know. Reception, the help desk, and anyone who would otherwise take a call from the former employee asking for a “quick favour”.

The week after

1. Watch the sign-in logs for attempts on the disabled account and for anything unexpected on the accounts it had access to. Huntress cloud security does this automatically for Microsoft 365.
2. Review what they administered. Systems where the departed person was the only administrator need a new owner and a checked recovery method.
3. Apply retention. Keep the mailbox and files for the period your policies or regulators require, then delete on schedule rather than on impulse.
4. Close the ticket with evidence. A record of what was disabled and when is what an auditor, an insurer or a court asks for later.

Making the checklist run itself

Most of this becomes a single step when three things are in place: single sign-on through Microsoft 365 or Google for every application that supports it, a password manager with shared vaults for the ones that do not, and device management for laptops and phones. Under a managed IT services plan, offboarding is a ticket the help desk works through a standard list the same day, with the record kept. It is also written into our what to expect page, because it is one of the first things a new client asks about.

The same checklist, reversed, is onboarding

A new hire needs the same list run forwards: identity, mail, files, applications, device, badge. Companies that run onboarding from a checklist find offboarding easy, because they know what was granted. Companies that grant access ad hoc over years find offboarding is guesswork, and the guesses are what breaches are made of. Our guide to setting up multifactor authentication covers the identity half.

Common questions

How quickly should access be removed?

On the last day, at an agreed time, and immediately if the departure is involuntary. Every hour of live access after someone leaves is a risk nobody is watching.

Should we delete the mailbox?

Not immediately. Convert it to a shared mailbox or forward it to the manager for a set period, keep it on hold if there is any legal reason to, and delete it only when the retention period ends. Deleting on day one loses customer history and can breach record-keeping rules.

What about accounts that do not use single sign-on?

Those are the ones that get missed. Keep a list of every service the company uses, who administers it and whether it is behind single sign-on, and work through it on the day. Password managers with shared vaults make this a ten-minute job instead of an afternoon.

Can we see whether a former employee is still signing in?

Yes, if someone is watching. Microsoft 365 and Google both log sign-ins; a monitoring service such as Huntress cloud security raises the alarm when a disabled or unexpected account is used.

Is this the same for contractors?

Yes, and contractors are missed more often because nobody in HR owns them. Every contractor gets an end date when their account is created, and the account is disabled on that date whether or not anyone remembers.

Talk to us

If someone left your company this year and you are not certain every login went with them, we will check and close what is open. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.