An employee offboarding security checklist helps a small business close access gaps when someone leaves. Disabling a work account is important, but it may not end active sessions, remove connected apps, or secure a phone or laptop. A consistent process makes it easier to protect email, company files, and payment systems without losing track of what still needs attention.
Plan access changes with the departure time and assign a person to own each task. The goal is to remove access promptly, then handle mailbox, file, and device handoff in a controlled way. CISA’s guidance on revoking credentials for departing employees is a useful reference for treating this as a defined security task.
Start with identity and email access
Begin with the accounts that can unlock other systems or expose sensitive communications. Coordinate with the employee’s manager and the people responsible for IT before the departure takes effect.
- Disable the work account. Block sign-in to the employee’s email and identity account at the agreed time. If the account is used to sign in to other services, check that those services also lose access.
- End active sessions. Where available, revoke active sessions, refresh tokens, and remembered devices. Changing a password alone may not sign out every existing session.
- Review sign-in recovery. Remove the departing employee’s phone number, personal email, authenticator methods, and other recovery options from company accounts. Confirm that an authorized business administrator controls recovery.
- Check mailbox settings and delegation. Look for forwarding rules, delegates, shared mailbox access, and connected apps. Remove access that is no longer needed, including permissions granted to third-party tools.
- Plan mailbox continuity separately. If a colleague needs business messages or files, arrange access through an authorized administrative process. Preserve what the business needs according to its policies, but do not leave the former employee’s sign-in active just to keep the mailbox available. Microsoft’s instructions for removing a former employee explain options for Microsoft 365 administrators.
For more context on responding to an email security concern, see this guide to securing a work email account and its data.
Revoke access to business applications and files
Make a list of the tools the employee used, including services that may not be managed through the main company account. Ask the employee’s manager and system owners to check their records rather than relying on memory alone.
- Remove the employee from collaboration, file storage, customer management, project, scheduling, and other business applications.
- Review administrator roles, shared folders, cloud storage links, and access to sensitive records. Transfer ownership of business files or workflows to an authorized colleague when needed.
- Disconnect third-party app integrations and revoke API keys, personal access tokens, or app passwords associated with the employee, where applicable.
- Remove the employee from remote access tools, virtual private networks, and any network or security systems they could administer.
- Check company password managers and shared credentials. Change shared passwords the employee knew, and update the approved password record so current staff can access them securely.
Removing a user from a central directory may not automatically remove access everywhere. Confirm the change within important services, especially those with separate sign-in arrangements or locally managed accounts.
Review financial and payment permissions
Access to money movement and financial records deserves a deliberate review. Check bank, payroll, accounting, expense, invoicing, and payment-processing platforms, along with any approval workflows or saved payment details the employee could manage.
- Remove the former employee’s user account, approval authority, delegated access, and payment privileges.
- Review who can add payees, change banking details, approve invoices, edit payroll information, or release payments.
- Check for unexpected changes to contact details, payment instructions, forwarding rules, or approval settings made around the departure.
- For payment or banking-detail changes, confirm the request through a separate, trusted contact method rather than relying on the email thread that carried the request.
The FBI’s Business Email Compromise guidance describes payment fraud that can involve deceptive email. Treat an email account as a possible impersonation route, and make independent verification part of the payment process.
Secure company laptops, phones, and other devices
Use an inventory to identify the equipment assigned to the employee, such as laptops, phones, tablets, security keys, and removable storage. Arrange return and record the device’s condition and handoff. If equipment cannot be recovered promptly, ask the person responsible for IT to use the organization’s available controls to protect company access and information.
- Remove the device from company management and revoke certificates or credentials where appropriate.
- Check that business accounts are signed out and company data is handled according to retention and security policies.
- Reset or reassign company-owned equipment before another employee uses it, following the organization’s process for protecting retained data.
- For a personal device used for work, distinguish company information from personal content. Use approved management tools to remove work access or work data; do not assume a full-device wipe is appropriate.
If the employee worked remotely, review this guide to securing remote work access and devices as part of the handoff.
Do not overlook physical access
Collect company keys, badges, access cards, and any equipment that can connect to the business network. Remove building or restricted-area access through the appropriate administrator. If the employee knew a shared door, alarm, or equipment-room code, consider whether that credential should be changed under your normal access-control process.
Assign owners and confirm completion
Offboarding can involve managers, IT, human resources, and finance. Use a written checklist that identifies who is responsible for each account, device, and approval system. Record when access was removed, what was transferred, and any items that remain open. This gives the business a clear handoff and helps prevent overlooked accounts from lingering.
After the immediate steps, review whether access was removed as intended. If the employee had elevated privileges or handled sensitive systems, check relevant account activity and escalate anything unexpected through your incident-response process. A broader data loss prevention approach can help make file access and retention easier to manage during staff changes.
Frequently asked questions
How quickly should a business revoke a former employee’s access?
Coordinate the timing with the departure and remove access promptly when it is no longer authorized. Prepare account owners and IT ahead of time so access changes can happen together rather than leaving a gap between the departure and the security steps.
Should a business change shared passwords when an employee leaves?
Change shared passwords the departing employee knew, and update them in the approved password manager or record. Also review who still needs access, so the business does not keep relying on credentials shared more widely than necessary.
What should happen to a former employee’s mailbox and files?
Disable the former employee’s sign-in, then arrange any needed mailbox or file access through an authorized administrator. Check forwarding, delegation, and connected apps, and follow company retention and access policies for business records.
Can a company wipe an employee’s personal phone?
Do not assume a full wipe is appropriate. First identify what company data or work profile is present, then use approved tools and policies to remove business access or data while respecting personal content.
Make offboarding a repeatable security step
A reliable departure process covers identity, email, applications, financial permissions, devices, and physical access, with a named owner for each action. Review your current offboarding checklist and identify any accounts or devices that lack a clear owner. If you need help organizing cybersecurity controls for your business, contact Zevonix to discuss your offboarding process.