Offboarding departing staff securely

Why offboarding is a security issue

Most departures are friendly, and most former employees have no intention of causing harm. The risk comes from what is left behind: active email accounts, cloud logins, shared passwords, remote access tools, company files on personal devices and access to vendor portals. Forgotten accounts are attractive to attackers because nobody is watching them, and they can remain active for months or even years.

A clear offboarding process protects the business and the departing person alike. It avoids awkward questions later, shows clients that their data is handled responsibly and supports privacy obligations under Alberta's Personal Information Protection Act. It also gives managers a predictable routine to follow, so nobody has to remember every step from memory during an already busy transition period.

Plan before the last day

Offboarding starts as soon as a departure is confirmed. The manager should notify HR and IT with the planned last day and any special considerations, such as a sudden or contentious exit. IT can then prepare a list of the person's accounts, devices, group memberships and shared access, so nothing is missed on the day.

Arrange a handover of work files, client contacts and ongoing projects. Decide what happens to the person's mailbox, for example converting it to a shared mailbox for a manager, setting an automatic reply or forwarding internal mail to a colleague for a limited period. Make these decisions in advance rather than under pressure.

On the final day

Disable access at the agreed time, ideally at the end of the final day or at the moment of departure for an involuntary exit. Disabling the main identity account, such as Microsoft 365 or Google Workspace, often removes access to many connected applications, but not all. Applications with separate logins need to be handled individually.

Collect all company equipment and make sure the person signs out of company apps on personal phones. If mobile application management is in use, remove company data from personal devices remotely. Thank the person and confirm any remaining arrangements, such as final pay or references. Record what was returned and when.

• Disable the main account and revoke sign-in sessions
• Reset or remove MFA methods
• Remove from shared mailboxes, groups and Teams
• Collect laptops, phones, keys and access cards
• Wipe company data from personal devices

Shared credentials and vendor access

The most commonly missed step is shared credentials. If the departing person knew passwords for shared accounts, such as social media, vendor portals, Wi-Fi or alarm codes, those passwords should be changed. A team password manager makes this much easier, because it shows exactly which shared items each person could access.

Check whether the person was a contact for vendors, banks or domain registrars. Update those contacts so that password resets and important notices reach someone who is still with the business. Remove the person as a signing authority or approver in banking and payment systems where applicable. Check website and social media admin roles too.

Review and improve

A week or two after the departure, review sign-in logs for any attempts to use the old account and confirm that all checklist items were completed. Keep a record of the offboarding steps taken, which is useful if questions arise later about access to client data. Then retain or delete their data according to your records policy.

Use each departure to improve the checklist. If something was missed, add it. Pair offboarding with regular access reviews, so that accounts belonging to contractors, temporary staff and people who changed roles are also caught. Consistency is what makes offboarding effective, not complexity. Keep the checklist where every manager can find it.