Why offboarding IT matters
Employee offboarding is the moment of highest IT security risk for most small businesses. A former employee with active credentials — email, cloud storage, business applications — is a significant security and data risk, even if the departure was amicable.
The checklist below covers what needs to happen on or before an employee’s last day.
Day of departure checklist
Immediately (before or at the moment of departure):
- Disable/suspend the user’s email account (suspend, don’t delete — you need to access their email for a transition period)
- Change passwords on any shared accounts the employee had access to (shared social media, shared admin tools, any shared credentials)
- Revoke access to cloud services: Google Workspace or Microsoft 365, Slack, project management tools, CRM, accounting software, and any other SaaS the employee used
- Disable VPN access if applicable
- Revoke physical access: building key cards, alarm codes, key fobs
Before the employee leaves the building:
- Collect company devices: laptop, phone, tablet, external drives
- Have the employee sign a document confirming they’ve returned all devices and don’t retain copies of company data on personal devices
Within 24 hours
- Transfer the departing employee’s files and email to their manager or successor. In Google Workspace: use the Data Migration or Transfer tool. In Microsoft 365: assign their mailbox as a shared mailbox and grant access to their manager.
- Set up an out-of-office auto-reply on their email directing contacts to the appropriate person
- Review what accounts the employee managed that need a new owner (domains, hosting, third-party tools in their name)
Within one week
- Factory reset or wipe company devices before reissuing or storing them
- Audit the departing employee’s access in your password manager — change any passwords they had access to that haven’t already been changed
- Remove them from any team communication tools (Slack, Teams, Discord)
- Update internal directories and org charts