When an employee leaves, disabling their email account is only one part of securing your business. They may also have access through cloud apps, remote connections, saved credentials, company devices, administrator accounts, and physical entry systems. A clear employee offboarding access checklist helps you find those access points, assign responsibility, and verify that access has actually been removed.
Plan the work around the employee’s departure and your organization’s policies. For an unexpected or higher-risk departure, coordinate closely with the appropriate managers and IT staff so access can be handled discreetly and promptly. The right timing and sequence depend on the circumstances, but the process should identify who acts, when they act, and how completion is recorded.
Prepare before access needs to end
Start with an inventory of the employee’s accounts, devices, permissions, and physical access. Don’t assume that the central company login lists everything. Ask the employee’s manager, IT support, and owners of key systems to identify tools used for their role, including accounts created directly with an app rather than through company sign-in.
- Name an owner for each task. Decide who notifies IT, who approves data handoffs, who collects equipment, and who confirms each system is addressed.
- Record the effective departure time. Use it to coordinate disabling access, returning equipment, and transferring important work. If the departure is unplanned, follow the organization’s established process for acting promptly.
- Identify business records and active work. Ask the manager to identify files, customer or operational work, and resources that must remain available to authorized staff.
- Check the level of access. Note whether the employee had administrator privileges, access to sensitive information, or credentials shared with coworkers or outside providers.
- Use a completion record. Track the system, assigned owner, action taken, and verification status in an approved internal record.
For a broader review of accounts and controls, an IT audit checklist for a small business can help reveal systems that are easy to miss during routine changes.
Employee offboarding access checklist
Central login, identity provider, and MFA
Disable the employee’s central company account at the agreed time. If your organization uses a single sign-on or identity provider, confirm the account is disabled there and check whether the employee can still authenticate directly to individual services.
- Revoke active sessions, sign-in tokens, and trusted-device access where the platform allows it.
- Remove or reset MFA methods and recovery options associated with the departing employee.
- Check alternate company accounts, aliases, or sign-in identities the person may have used.
Disabling a central account is an important step, but it may not end every existing session or app-specific login. NIST’s security and privacy control guidance includes account management and access enforcement as areas organizations should address in their control processes.
Email, messaging, and shared files
Disable the departing employee’s mailbox and messaging access according to your company’s procedures. Before changing or removing anything, determine how authorized staff will handle business correspondence and records. Set up an approved handoff, such as assigning a manager to manage relevant messages or transferring ownership of work files.
- Review email, calendars, chat, video meetings, and collaboration tools.
- Check for forwarding rules, delegates, shared mailboxes, and connected apps.
- Transfer ownership of business documents, folders, calendars, and project resources as appropriate.
- Preserve records under your organization’s retention and data-handling policies. Avoid deleting an account or its contents before confirming what must remain available.
Cloud services, business apps, and remote access
Review the employee’s cloud accounts and business applications individually. Include file storage, finance and customer systems, project tools, HR platforms, website administration, and any specialized software used for the role. Check direct logins as well as access provided through company sign-in.
Also remove access to VPNs, remote desktops, virtual private networks, support tools, and other pathways into company systems. Look for app integrations, API tokens, saved credentials, or access granted through a third-party provider. Ask system owners to confirm removal rather than relying only on the central account change.
Devices, shared credentials, and administrator access
Arrange the return of company laptops, phones, security keys, and other equipment. Record what was returned and what remains outstanding. For company-managed devices, use your approved process to sign out, secure, reassign, or erase them. If the employee used a personal device for work, follow your policy for removing company access and business data without making assumptions about personal content.
- Rotate shared passwords and secrets the employee knew or could retrieve, including shared accounts, Wi-Fi credentials, service credentials, and stored keys. Update the authorized users and record the change securely.
- Review administrator access. Remove elevated permissions across identity systems, cloud platforms, network equipment, websites, backup tools, and security products.
- Check for remaining privileged paths. Review alternate admin accounts, recovery methods, remote management tools, and credentials managed by outside providers.
- Update physical access. Collect keys and badges, and remove access to offices, storage areas, or other controlled spaces as appropriate.
Removing a named employee account and changing shared credentials are separate tasks. Both matter when someone knew a shared password or held a privileged role. CISA’s guidance on managing risk during employee separations discusses planning and coordinated actions for higher-risk departures.
Preserve continuity and handle sensitive information carefully
Access removal should not leave the business unable to reach its own records or continue important work. Confirm that a manager or other authorized employee can access needed company files, shared resources, and work in progress. Transfer ownership through approved administrative controls rather than asking coworkers to use the departing employee’s account.
If the employee handled regulated or sensitive information, involve the appropriate privacy, security, or compliance lead. Follow the organization’s approved procedures for preserving records and removing access. Businesses that need to review their compliance processes can explore small business IT compliance considerations.
Verify access removal and record completion
Before closing the offboarding task, ask each system owner to confirm the account is disabled or removed and that any required transfer is complete. Check account inventories, administrator role lists, active sessions, recovery methods, device status, and shared credentials. Review relevant system records where available and appropriate to confirm that access changes took effect.
Keep a record of outstanding equipment, systems that could not be checked, and any follow-up assigned to an owner. If a system is managed by a vendor, request confirmation from that provider and document the response. A completed checklist is more useful when it shows what was checked and who verified it, not just that a request was sent.
Frequently asked questions
When should a departing employee’s access be disabled?
Coordinate the timing with the departure plan and company procedures. For an unplanned or higher-risk departure, involve IT and the appropriate managers so access can be disabled promptly and in a controlled way.
Should passwords be changed when an employee leaves?
Change shared passwords, keys, or secrets the employee knew or could access. A personal account password is not a substitute for disabling the employee’s company account, and shared credentials should be managed separately.
What if the employee had administrator access?
Review every platform where the employee held elevated permissions, remove those privileges, and check for alternate accounts, recovery methods, remote access, and credentials held by outside providers. Have the relevant system owners verify the changes.
What additional steps may apply to healthcare businesses handling ePHI?
Involve the organization’s privacy or compliance lead and follow its approved procedures for access, records, and company devices. The details depend on the organization’s systems and policies, so avoid treating a general checklist as a substitute for its compliance process.
Make offboarding a repeatable security task
A reliable process covers more than the main login. It includes apps, active sessions, devices, shared credentials, administrator privileges, physical access, business records, and a final verification. Assign owners and keep a record so important steps do not depend on memory.
If your business needs help reviewing account access or building a repeatable offboarding process, contact Zevonix at (904) 658-0777.