The Secure Employee Offboarding Checklist for Lean IT Teams

Agree the timing and the owner before the last day

A departure involves HR, the manager, and whoever administers business systems. Create one offboarding record with an approved access cutoff, a responsible person, and a list of services. Include contractors and temporary staff in the same process.

NIST SP 800-53's personnel termination control calls for disabling access within an organization-defined period, revoking credentials, recovering property, and retaining organizational information. It does not prescribe one universal deadline for every business. Set timing with HR and IT based on your policy and the circumstances.

Prepare the handoff without destroying evidence

Identify business files, shared resources, and automated tasks owned by the departing person. Transfer ownership through the service's supported administration tools. Check retention requirements or legal holds before deleting accounts, mail, or files.

• Inventory email, identity provider, VPN, finance, collaboration, and administrator accounts.
• Identify services outside central sign-in, including vendor portals and social media.
• Transfer shared documents, calendars, billing ownership, and scheduled automations.
• Record the approved handling of business data and company devices with HR and IT.

At the cutoff, revoke access—not just the password

Follow each provider's offboarding procedure. Disabling central sign-in may not remove an existing session or a separate account in every application. Review sessions, recovery methods, app permissions, and individual tokens where your administration tools support it.

• Disable the person's accounts and remove group memberships and privileged roles.
• Revoke active sessions and individual access tokens using provider-supported controls.
• Rotate shared secrets the person knew and update dependent services safely.
• Recover laptops, phones, security keys, badges, and physical access cards.
• Confirm separate SaaS accounts and remote-access permissions are closed.

Verify the outcome and retain a useful record

Have a responsible administrator check each system and record the completion time, exceptions, and follow-up owner. Do not assume that collecting a laptop or resetting an email password finishes the job.

Check that the business can still access transferred information and that important automations continue working. Route requests for former employees through approved business processes rather than sharing their old credentials. Apply your privacy and retention policy when handling personal or sensitive material.

Make the next departure easier

Use individual accounts, maintain a service inventory, and keep ownership information current. Periodic access reviews can find forgotten accounts before an offboarding event. A short checklist that is consistently completed is more useful than a long policy nobody can operationalize.

This checklist is practical guidance, not a certification or a substitute for employment, privacy, or regulatory advice. Adapt the steps to your systems and the obligations that apply to your business.