Employee offboarding security checklist
Most access problems after someone leaves come from process gaps, not technology: nobody told IT, a shared password wasn't changed, or a laptop came back weeks late. This checklist gives HR, managers and IT one sequence to follow, from the day notice is given to the final sign-off.
Reviewed by the ITRS security team · Last updated
Before the last day
The moment notice is given (or a termination is planned), HR should tell IT. Agree the exact end date and time, and whether the departure is routine or sensitive.
- Classify the departure: routine, sensitive (going to a competitor, access to trade secrets or client lists) or hostile. Sensitive and hostile departures may need access cut at the moment of the conversation, not at end of day.
- List every system the person uses, from the access records, not from memory: Microsoft 365 or Google Workspace, accounting, practice management, CRM, banking, payroll, VPN, building access, social media accounts, domain registrar.
- Identify what they own: Teams, SharePoint sites, shared drives, automation flows, vendor relationships, client contacts.
- Plan the handover of open work and client communications.
- For sensitive departures, consider preserving the mailbox and laptop before anything else changes, and talk to counsel.
On the last day
The technical steps for Microsoft 365 are in our separate guide, "Offboarding a user in Microsoft 365 the right way".
Disable sign-in at the agreed time
Block the account and revoke active sessions in the identity platform, not just reset the password.
Remove MFA methods
So the account can't be re-registered from the person's phone.
Collect equipment
Laptop, phone, tokens, keys, access cards. Check serial numbers against the asset register.
Remove work data from personal devices
Issue a selective wipe of managed apps on personal phones.
Set mail handling
Auto-reply, forward or shared-mailbox conversion as agreed.
Exit conversation
Remind the person of confidentiality obligations and ask them to confirm they have returned or deleted company information.
Shared accounts and passwords
Shared credentials are the gap that outlives every offboarding. The Canadian Centre for Cyber Security's baseline controls call for access control based on least privilege and individual accounts; where shared accounts still exist, every one the person knew must be rotated.
- Rotate passwords for shared mailboxes, social media accounts, Wi-Fi, alarm codes, vendor portals and any account in the shared password vault they could see.
- Remove them from the password manager's shared folders.
- Change MFA on any shared account that used their phone.
- Check the domain registrar, DNS host and website admin: these are often in a single person's name.
Devices and data return
- Confirm every company device is back and logged in the asset register.
- Hold returned laptops for a set period (for example 30 to 90 days) before reimaging, longer for sensitive departures, so evidence is still available if a question arises.
- Transfer files from OneDrive or personal drives to team locations.
- Recover company data from personal cloud storage if the person used it, with a written confirmation.
After departure: monitoring and records
For a few weeks, watch for sign-in attempts against the disabled account, unexpected forwarding rules, and access to shared resources from unknown devices. Tell key clients and vendors who the new contact is, especially for payments: departing staff are a common pretext for payment-redirection fraud, where a fraudster claims to be the new contact.
Keep the offboarding record. The OPC's workplace privacy guidance notes that privacy obligations extend to former employees, so their personnel and monitoring records still need proper safeguards and retention.
Sign-off
A manager and IT both sign off, with the date. If any item is waived, record why.
| Item | Owner | Done |
|---|---|---|
HR notified IT with date and departure type | HR | ☐ |
Sign-in blocked, sessions revoked, MFA methods removed | IT | ☐ |
Data preserved per retention or hold | IT / counsel | ☐ |
Equipment returned and logged | Manager / IT | ☐ |
Shared passwords rotated | IT | ☐ |
Clients and vendors told of new contact | Manager | ☐ |
Licences removed / account deleted on schedule | IT | ☐ |
Questions we hear
For routine departures, at the agreed end time. For sensitive or hostile departures, during the meeting, so the person never returns to a working account.
Follow your retention schedule; set it once in policy. Holds for disputes override it.
HR starts it, IT executes the technical steps, and the manager confirms handover and equipment. One person, usually in HR, tracks it to sign-off.
Related reading.
- PracticeManaged IT SupportHelpdesk and break/fix, networking, security systems, devices, Microsoft 365, cloud and backup.
- GuideOffboarding a user in Microsoft 365 the right wayDeleting a departing employee's account is the fastest way to lose their email, their files and any evidence you might later need.
- GuideWhat to do if a former employee still has accessYou've found that someone who left can still sign in somewhere: email, a SaaS app, the VPN, a shared password. Cut the access, then find out whether it was used.
- GuideWhat to do if you suspect an employee took company dataWhen you suspect someone is leaving with client lists, files or source code, the order of your next steps decides whether you end up with evidence or with a wiped laptop…
- GuideEmployee onboarding security checklistThe first week sets habits that last years. If a new hire gets admin rights "just to get started", skips MFA because IT was busy, or never hears how to report a…
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.