The Employee Offboarding IT Checklist Most Businesses Skip
Forgotten accounts belonging to people who left are the most common way attackers get in.
In short: the IT checklist when somebody leaves runs on the day, not the week after. Disable rather than delete, revoke sessions, redirect email, and work through the IT checklist for shared logins and personal devices too.
Ask most businesses how many active accounts belong to people who no longer work there and the honest answer is that nobody knows. That number is the single most common way an attacker walks in through the front door.
Employee offboarding IT is not complicated. It is just easy to forget in the week somebody leaves.
On The Last Day
Disable, do not delete. Deleting an account can destroy files, calendar history and shared ownership. Disabling stops access immediately and keeps everything.
Revoke active sessions, not just the password. A signed-in phone can keep working for weeks after a password change if the sessions were never cut.
Collect the hardware and note the serial numbers. A laptop that goes home permanently is a device you cannot patch and cannot wipe.
Forward or delegate the mailbox to a named person, and set an auto-reply that tells senders who to contact instead.
In The Following Week
Find the shared logins they knew. Wi-Fi keys, the shared finance login, the social media account, the alarm code. Any of those they could recite is now a shared secret with a former colleague.
Check what they owned rather than only what they used: documents, calendars, licenses, subscriptions, DNS records and domain renewals sitting on a personal email.
Remove them from any group that grants access by membership. This is where accounts most often survive a proper offboarding.
Make It Repeatable
Write it down as a checklist and give it to whoever handles leavers. It should not depend on remembering.
Tell us when somebody is leaving, ideally before the day rather than two weeks after. A five-minute heads-up removes most of the risk.
Ask us once a quarter for a list of accounts that have not signed in for ninety days. It is a short list and it is always interesting.
A One-Minute Test Using Your Last Leaver
Here is a test that takes one minute. Name the last person to leave your business, then say without looking anything up whether their account is disabled, who reads their mail, and where their laptop is.
Any answer that is a guess means the IT checklist was not fully run for them, and that gap is still open today. Close it for that person first, then use what you learned to tighten the list for the next departure.
IT Checklist Mistakes That Leave A Door Open
Signing in as the leaver to keep things running is a frequent mistake. It keeps a live password in circulation and muddles the record of who did what. Ask for access to be delegated to whoever takes over instead.
Missing their mailbox forwarding rules is another. A rule copying mail to a personal address keeps working after sign-in is blocked, because the mailbox still receives mail. Add a check of mailbox rules to the IT checklist.
Leaving their direct phone number ringing into an empty extension frustrates clients. Point it at a colleague or a queue on the last day and update the voicemail greeting.
Wiping the returned laptop the same afternoon can destroy work. Files saved to the desktop or a local folder may never have reached shared storage, so have someone look before the machine is reset.
When To Call Us About A Leaver
Any sign-in or sent message from a former colleague’s account after their last day is a security matter. Call 678-374-4352 and choose option 1 for the security line, which is answered 24/7. The same goes for clients who say they heard from that address recently.
Call the help desk if the person who left was an administrator of anything, or the only owner of a system, because the IT checklist alone does not hand those over. The desk is open Monday to Friday, 8 AM to 5 PM Eastern, and takes emergencies 24/7, so an abrupt evening departure can be reported straight away.
Do It On The Day, Not In The Week After
The gap between somebody leaving and their access being removed is where most avoidable incidents live. It is rarely malice. It is usually that nobody told IT, and an active account with a known password sits there for three months.
The whole IT checklist takes minutes if we know it is happening. Disable the account, revoke the sessions, redirect the mail, collect the devices. The reason it turns into a week-long job is that it starts a week late and has to be reconstructed from memory.
For an amicable departure with notice, tell us the date as soon as you know it and we will have everything staged and ready to run at the right hour.
For an immediate departure, call rather than email, because in that scenario the order changes and minutes count.
Email Is The Part That Needs A Decision
Every other item on the IT checklist is mechanical. Email is the one that needs a human decision, and making it in advance saves a lot of awkwardness.
Decide who receives their mail after they leave. A named colleague, a shared mailbox, or their manager. Then decide for how long, because forever is not an answer and thirty days usually is.
Decide whether an automatic reply goes out and what it says. Something plain that names a replacement contact is better than silence, and much better than a bounce that tells clients nobody works there anymore.
And decide who reviews the mailbox for anything the business needs. Contracts, commitments, ongoing threads with clients. That review is the difference between a clean handover and finding out in six weeks that an order was never placed.
If there is any legal or compliance dimension, and for a law firm there usually is, that decision is yours rather than ours, and we will do what you tell us.
The Accounts Outside Our Systems
The parts of the IT checklist that get missed are the accounts we cannot see because they were never set up through us.
Supplier portals and courier accounts registered in their name. Social media logins. The domain registrar. Payment and banking access. Software they signed up for on a card and expensed. Any of these can be tied to a personal email address that we have no visibility into.
The practical fix is a list, maintained while people are employed rather than assembled when they leave. A shared password vault does most of this automatically, because the credential lives with the business rather than with the person.
For anyone leaving now, walk through their actual working week with them or with their manager and write down every system they touched. Ten minutes of that beats three months of discovering things.
Then check whether anything is registered to their personal email and get it moved before their last day.
Devices, And The Personal Phone Problem
Collecting the laptop is obvious. The one that gets missed is the personal phone with work email on it, because nobody thinks of it as a company device.
If work mail was on a personal phone, that access needs removing on the last day exactly like a company laptop. In a managed setup we can remove the work account and its data without touching anything personal, which is the outcome everyone wants.
Do the same for the 3CX app, any file sync app, and anything else with a saved session.
Also collect the small things. Hardware security keys, access fobs, and any second factor device. A leaver still holding a registered security key is an open door that no password change closes.
Finally note the serial numbers of returned equipment. It sounds bureaucratic until the day somebody asks whether a specific laptop came back.
Related Guides And What To Have Ready
Related: using a password manager, which prevents most shared credential problems in the first place, and reporting a security incident if a departure turns difficult. More in Getting help.
To run the IT checklist we need four things: the person’s name, their last working day, who should receive their email and for how long, and whether the departure is amicable.
Call 678-374-4352 or send those four lines in a ticket as soon as you have a date.
For a broader view of access control at offboarding, see CISA Secure Our World.
The IT Checklist, In Order, For The Last Working Day
Run this IT checklist on the day, not the week after. Every line takes seconds if we have notice.
- Disable the account. Do not delete it.
- Revoke active sessions on every device they used.
- Redirect email to a named colleague, and decide for how long.
- Set an automatic reply naming a replacement contact.
- Have someone review the mailbox for commitments and open threads.
- Collect the laptop, and note the serial number.
- Remove work email from any personal phone.
- Collect security keys, fobs and any second factor device.
- Work through the IT checklist for shared logins they alone knew.
- Check nothing is registered to their personal email address.
The last two lines are the ones that get missed, and they are the ones still open six months later.
What The IT Checklist Protects In Your Industry
The risk of a slow departure process is not the same everywhere.
Law firms. A departing attorney’s mailbox contains live client matters. The IT checklist here is as much about continuity as security, because an unread client email during a handover is a service failure before it is a risk.
Distribution and logistics. Departures on an order desk leave supplier and courier accounts registered to one person. Without an IT checklist these surface months later when somebody cannot log in to arrange a pickup.
Manufacturing. Access to plant and maintenance systems is often granted informally and never reviewed. That makes the IT checklist the only moment anyone audits who can reach what.
Give us a name and a last working day as soon as you have one and we will stage it. Call 678-374-4352.
Building The IT Checklist Into How You Hire And Leave
The reason the IT checklist gets run late is almost never carelessness. It is that IT finds out last, because departures are handled by whoever manages the person and there is no step in that process that involves telling us.
The fix is to put it in the same place as the other leaver admin. Whoever handles the final payroll, the reference and the equipment return should also send us a name and a last working day. One line in an email is enough for us to stage the entire IT checklist in advance.
The mirror image is worth doing too. Building the same list into onboarding means you always know what a person was given, which makes the IT checklist at the other end a matter of reversing a known list rather than reconstructing one from memory.
For a business of any size, that record is the difference between a five-minute offboarding and a two-week archaeology exercise.
It also protects the departing person. A clean, documented handover means nobody is calling them three weeks later asking for a password.
What The IT Checklist Looks Like For A Difficult Departure
Most departures are amicable and the IT checklist runs at a normal pace. Occasionally one is not, and the order changes.
In that situation, tell us before the conversation happens rather than after. Access can be staged so it is removed at a specific moment rather than scrambled for afterward, and that is a materially different outcome.
The sequence becomes revoke sessions first, then disable the account, then deal with email and devices. The reason is simply that an active session on a phone or laptop continues to work after a password change, and closing that window is the whole point.
Nothing about this needs to be dramatic or visible. It is the same IT checklist run in a different order, and done properly nobody outside the conversation notices anything.
We will not ask why. We only need to know whether the departure is amicable so we can pick the right sequence. Call 678-374-4352.
Questions About Employee Offboarding IT
No. Disable it, keep the data, decide later.
Delegate or forward to a named person and set an auto-reply.
Ask them before they go, then change them anyway.
Yes. Tell us a leaver is coming and we do the technical half.