Employee Offboarding IT Security Checklist

Most businesses are good at giving people access. They are much worse at taking it away. A former employee who can still read the shared inbox, log in to the CRM or post on the company’s social accounts is a real risk, whether they left on good terms or not. Even a friendly departure becomes a problem when that person’s old password leaks in an unrelated breach months later.

The FTC’s guide to protecting personal information tells businesses to have a procedure so that workers who leave no longer have access to sensitive information, and to terminate their passwords and collect keys and ID cards as part of the check-out routine. That is the core of IT offboarding. This checklist turns it into a same-day routine any small business can follow.

Why offboarding fails

Access usually lingers for predictable reasons:

• Nobody owns it. HR thinks IT handles it, and IT finds out a week later.
• Accounts live everywhere. Staff sign up for cloud tools with their work email, and nobody has a full list.
• Shared passwords. The person knew the logins to the social accounts, the supplier portal or the Wi-Fi, and nobody changes them.
• Personal devices. Company email and files sit on a personal phone or laptop.
• Timing. Access is removed at the end of the notice period, not when the person actually stops working.

NIST’s security control for personnel termination, PS-4 in SP 800-53, asks organizations to disable access within a time period they define, revoke credentials and retrieve security-related property. Many organizations set that window at a few hours for involuntary departures. For a small business, “before the end of the last working day” is a sensible minimum.

Before the last day

Good offboarding starts a few days before someone leaves, or the moment a termination decision is made.

• Confirm the date and time that access should end, and who the person’s manager or data owner is.
• Pull the access list. Check your identity provider, password manager and app admin consoles for every account the person has.
• Identify shared credentials they know, including social media, banking, vendor portals, Wi-Fi and alarm codes.
• Plan the handover. Agree who takes over their email, files, open tickets, client relationships and recurring tasks.
• Check for admin roles. Anyone with admin rights to email, cloud, domain, website or finance systems needs a careful handover, because removing the only admin can lock you out.
• For involuntary exits, schedule access removal to happen at the same time as, or just before, the conversation.

The same-day offboarding checklist

Work through this list in order on the last day. Revoking the main identity first cuts off most access in one step.

If you use single sign-on with automatic provisioning, steps 1 and 7 collapse into one action for every connected app. That is one of the strongest reasons to adopt it.

Key takeaway: Disable, do not delete, on day 1. Disabling stops access instantly while keeping email, files and logs available for handover, investigations or legal holds. Delete later, on a schedule.

Revoking access the right way

A few details make the difference between real revocation and the appearance of it.

Kill sessions, not just passwords. Changing a password does not always sign someone out of apps that are already open on their phone or laptop. Use the “sign out of all sessions” or “revoke sessions” control in your identity provider and key apps.

Remove MFA devices. If their phone stays registered as an MFA method, a later account reactivation could let them back in. Clear their registered methods. Our guide to multi-factor authentication covers how these methods work.

Look beyond the directory. Check tools people often sign up for on their own: design apps, file transfer services, AI tools, marketing platforms, code repositories and app stores. Expense reports and company card statements reveal many of these.

Check third-party app connections. Employees often grant outside apps permission to read their mailbox or files. Review and remove those connections, since they can keep working after the password changes.

Rotate secrets they touched. Anything they could see or copy should be treated as known: shared logins, API keys, service account passwords and Wi-Fi keys. A business password manager shows exactly which shared items the person had access to, which makes this much faster.

Recovering devices and company data

Company-owned devices. Collect laptops, phones, tablets, security keys and storage drives. Check them in against your asset list, then reset them before giving them to someone else. Keep a laptop untouched if there is any chance of a dispute or investigation.

Devices not returned. If a company laptop or phone is enrolled in mobile device management (MDM), you can lock or wipe it remotely. That is a good reason to enroll every company device on day 1 of employment, not the last.

Personal devices. For phones and laptops the employee owns, remove company accounts and use your MDM or email platform’s selective wipe to remove only company data. Your bring-your-own-device policy should tell staff in advance that this will happen.

Transferring data and responsibilities

The goal is that nothing breaks and nothing is lost.

• Email. Convert or delegate the mailbox to the manager, and set an auto-reply pointing contacts to the right person. Avoid keeping a former employee’s mailbox active and forwarding indefinitely.
• Files. Move files from their personal drive into a shared team location. Cloud suites let admins transfer file ownership.
• Calendars and recurring meetings. Reassign meetings they organized, so invites keep working.
• Accounts registered to their email. Change the account owner or recovery email on vendor, domain, ad and social media accounts to a shared role address such as admin@ or billing@.
• Retention. Keep records for as long as your industry, contracts or a legal hold require before deleting accounts. This is not legal advice; check retention needs with your attorney or compliance lead.

After the last day

Offboarding is not finished when the person walks out.

• Day 1 to 7: review sign-in logs for any attempts on the disabled account, and confirm no forwarding rules send company mail to an outside address.
• Day 30: run a short audit for accounts you missed. Search app admin consoles for the person’s name and email.
• Day 30 to 90: delete or archive the account according to your retention policy, and release the license.

If you spot suspicious activity, treat it as a security incident. Our guide on how to create an incident response plan explains how to prepare.

Where to start if you have no process today

1. Write the checklist down. Copy the table above into a shared document or ticket template.
2. Name an owner for each step: HR triggers it, IT or your managed service provider executes it, and the manager confirms the handover. CISA’s Insider Threat Mitigation Guide, refreshed in a 2026 edition, likewise frames insider risk as a job for a multi-disciplinary team rather than IT alone.
3. Build an app inventory. List every system, who administers it and whether it is connected to SSO.
4. Centralize sign-in where possible, so disabling one account removes most access.
5. Use shared role addresses for vendor and social accounts, so they never depend on one person.

Limiting what each person can access in the first place, a core idea in zero trust security, also means there is less to remove when they go.

Conclusion

Offboarding is a security control, not just an HR formality. Disable the main account first, kill sessions and MFA, rotate the shared secrets the person knew, recover or wipe devices, and hand over data deliberately. Then audit 30 days later. A 15-step checklist used every time beats a perfect process nobody follows.

Sources

• FTC: Protecting Personal Information, A Guide for Business — terminate passwords and collect keys and ID cards when workers leave
• NIST SP 800-53 Rev. 5: Security and Privacy Controls — control PS-4, Personnel Termination: disabling access within a defined time, revoking credentials and retrieving property
• CISA: Insider Threat Mitigation Guide — building a multi-disciplinary insider risk program