Short answer: When an employee leaves, turn off their access the same day: email and cloud accounts, shared passwords, remote access, company devices and door credentials. The safest offboarding happens from a written checklist, so nothing depends on someone remembering.
Most small businesses are good at the HR side of a departure and less consistent with the technology side. An account that stays active for weeks after someone leaves is one of the easiest ways for data to walk out the door.
Why does offboarding matter for security?
Former employees usually do not mean any harm. The risk is that their access keeps working when nobody is watching it. An old email login, a saved password on a personal phone or a door fob that still opens the back entrance can all be used later, by them or by someone who gets hold of their credentials.
A checklist also protects the business. It makes sure files, email history and customer contacts stay with the company and are handed to the right person.
Before the last day
- Pick a time for access to end and tell IT ahead of time.
- List what the person can access: email, cloud apps, line-of-business software, banking or payment portals, social media accounts, vendor portals.
- Plan who takes over their email, files, open projects and customer contacts.
- List the devices they have: laptop, phone, tablet, hotspot, keys, badge and fob.
On the last day
- Disable the user account in your email and cloud system rather than deleting it right away, so mail and files are kept.
- Sign them out everywhere and reset their password so saved sessions on phones and home computers stop working.
- Remove multi-factor devices tied to their account.
- Shut off remote access, such as VPN or remote desktop.
- Change shared passwords they knew, such as Wi-Fi, shared mailboxes or vendor logins.
- Forward or delegate email to their manager or replacement.
- Turn off their door credential in the access control system.
- Collect devices, keys, badges and fobs.
After they leave
- Wipe or reissue company devices once files are saved.
- Remove them from company phone systems, voicemail and call groups.
- Check for forwarding rules in their mailbox that send mail outside the company.
- Review licenses so you are not paying for an account nobody uses.
- Keep a record of what was done and when.
Do not forget the doors
IT accounts are only half of it. If your building uses keys, a departing employee may still have one, and rekeying every lock is expensive. With card, fob or phone-based access control, you turn off their credential in seconds and get a log showing it no longer works. If your business also works with our sister company, Turner Security, both sides can be handled together.
Frequently asked questions
Should I delete a former employee's email account?
Usually not right away. Disable it first so email and files are kept, give access to their manager, then remove or convert the account later based on your retention needs.
How fast should access be turned off?
The same day the person leaves, ideally at the time their employment ends. For a difficult departure, access should end before or during the conversation.
What if the employee used a personal phone for work?
Signing them out of company accounts and resetting their password stops company email and apps on that phone. If your business uses device management, company data can often be removed from the phone without touching personal data.
Who should own the offboarding checklist?
Usually the owner or office manager owns it, with IT handling the technical steps. What matters is that it is written down and used every time.
Get help building your offboarding process
TechCore provides managed IT and help desk support for businesses in Nashville, Middle Tennessee and Chattanooga. We can help you set up a repeatable offboarding checklist and handle the account and device steps for you.
Contact TechCore to talk through your current process.
