Employee Offboarding Security Checklist: Close Every Door Before They Leave

Why offboarding is a security issue

Most departures are friendly, but access that lingers is still a risk. Old accounts are not monitored, passwords may be reused elsewhere and a forgotten login can be taken over by an attacker. In the rarer case of a disgruntled leaver, delay can mean deleted files or copied customer data.

A checklist removes the guesswork. It also protects the person leaving, because it shows that you handled their departure consistently.

Before the last day

Preparation makes the final day smooth. Decide who owns the process, and gather information early.

• Confirm the leaving date and who will be told, and when
• List every system the person uses, including tools they signed up for themselves
• Identify shared accounts and passwords they know
• Plan who will take over their files, mailbox, customer relationships and approvals
• Arrange to collect laptops, phones, badges, keys and tokens

On the last day: accounts and access

Disable the main sign-in first, because that cuts off email, cloud storage and single sign-on applications in one step. Then work through the services that sit outside it.

• Suspend the email account and sign out all active sessions
• Remove from the password manager and shared vaults
• Revoke access to the VPN, remote desktop and cloud admin consoles
• Remove from messaging, project and customer relationship tools
• Disable multi-factor authentication devices registered to the account
• Check for email forwarding rules and delegated access

Devices and data

Collect company equipment and verify that nothing important is stored only on it. Wipe and reissue laptops according to your process, and keep a record of the serial number and condition when they come back.

For personal devices, remove work email, files and app logins. Remind the employee in writing of their confidentiality obligations, and agree what happens to any business data on personal cloud storage. Transfer ownership of documents, calendars and shared drives to a named colleague before the account is deleted, because deleting an account can remove files nobody else owns.

Rotate shared secrets

Anything the person could still use should be changed. That includes shared passwords, API keys, Wi-Fi passphrases that were not unique, door codes and bank portal logins. Your password manager makes this easier by showing which entries the person could see.

Also review third-party services where they were the only administrator, such as your domain registrar, social media pages and advertising accounts. Add a second admin to each of these now, so no single departure can lock you out.

Special cases that need extra care

Not every departure is the same, and a checklist should include variations. When a person leaves on difficult terms, or holds a senior or technical role, timing and communication change. Access is often removed at the same moment the conversation takes place, with a colleague ready to handle the technical steps, so there is no gap in which something can be copied or deleted.

Administrators and developers deserve particular attention. They may hold keys, tokens and credentials that are not tied to a personal login, such as API keys in code, service accounts, domain registrar access and payment processor settings. Ask them to document and hand over these items before they go, then rotate anything sensitive afterwards.

Remote and part-time staff are easy to overlook, since there is no desk to clear. Make sure that returning equipment is arranged, with tracked shipping, and that you have confirmed receipt before you close the process. For seasonal workers and interns, set an automatic end date on accounts when they are created, so that offboarding happens even if everyone forgets.

A one-line summary to pin up

People remember short rules. Pin this where the team who handle departures can see it.

• Disable sign-in, then sessions, then everything else
• Collect devices and verify nothing is stranded on them
• Transfer files and mailbox before deleting anything
• Rotate shared secrets the person could see
• Update the account inventory and learn from what was missed

After they leave

Monitor for sign-in attempts on the old account and for unusual activity involving their former access. Keep the suspended mailbox for the retention period you set, then delete it. Update your account inventory and organisational chart.

Finally, review how it went. If you found accounts you did not know existed, add them to the master list. Offboarding is the best test of how well you know where your company data actually lives.