IT Offboarding: What to Do When an Employee Leaves

The email usually arrives weeks later, and it is short: "I think my old assistant still has access to the shared drive."

By then, the person has been gone for a month. Nobody meant to leave the door open. The last week was busy, the handover was verbal, and the account cleanup kept getting pushed to Monday. Then Monday became next month.

Offboarding is the least glamorous IT task there is. It is also one of the few where a small mistake stays invisible for a long time and then becomes very visible at once. Here is the process we run.

Start When the Notice Arrives, Not on the Last Day

The moment you know someone is leaving, write down what they can reach. Email, shared drives, the client database, the accounting system, the phone system, the camera app, the social media accounts, the vendor websites that have the company card saved. Do it while they are still there to ask.

This is not about suspicion. Most people leave well and want a clean handover. The list exists because nobody remembers all of it on a Friday afternoon.

The Last Day

Pick a time and cut access then

For a planned departure, a common approach is to disable sign-in at the end of the last working day, after the goodbye and before anyone goes home. For an involuntary departure, it happens at the start of the conversation. Either way, the decision is made in advance so nobody has to improvise.

Collect the hardware

Laptop, phone, badge, keys, any token or security key. Check the laptop in front of the person if you can. A missing charger is minor. A missing laptop is a data question.

Turn off the phone extension

On a hosted business phone system in Central PA, remove the extension or forward it to a colleague. A former employee's voicemail greeting is an awkward thing for a client to hear a week later.

The Same Day, Before You Go Home

Kill the sessions, not just the password

Changing a password does not always sign someone out. Reset the password, then revoke active sessions and refresh tokens in every service that offers it. Check the mailbox, the file storage and the line-of-business app separately, because they rarely share a switch.

Remove the second factors

An authenticator app, a personal phone number, a hardware key. If the old phone still receives codes, the account is not closed. Remove the device from the account's security settings, then confirm the person can no longer approve a sign-in.

Check the phone and the home computer

If work email is on a personal phone, remove the work profile or the account. If the person used a home computer, sign out of the browser. This is the step businesses skip most often, because it happens outside the office and outside the checklist.

Take back the password manager

If the company uses a shared vault, remove the person and rotate any shared credential they could see. A shared password that leaves with an employee is a password you no longer control.

The Following Week

• Mailbox: forward to a manager or convert to a shared mailbox, then set an auto-reply. Decide how long to keep it. Do not let it sit unmonitored for a year.
• Files: transfer ownership of documents and folders. A file owned by a disabled account can become unreachable in some systems, which is a quiet way to lose a project.
• Groups and lists: remove from distribution lists, team chats and shared calendars.
• Third-party sites: the supply ordering site, the travel booking site, the industry portal. These are the accounts nobody tracks, and they often hold a saved card.
• Physical access: badge, alarm code, keys, parking. IT can close every account and still leave a working key in someone's pocket.
• Social media: remove access, change the password if it was shared, and check who else is an administrator.

What People Forget Most

Three things, in our experience. The mobile device, because it lives in a bag rather than in the office. The third-party website, because it never appears in the company directory. And the shared password, because it works for several people and nobody wants to be the one who changes it.

None of these requires a sophisticated attacker. They just require time. A closed account is a dead end. A forgotten one is an open door that nobody is watching.

Do It Kindly

Offboarding is not an accusation. A good process protects the person leaving as much as the business: their files are handed over, their accounts are closed cleanly, and no one can later use their name to get in. Explain that when you do it. Most people are relieved.

If you need to preserve records for a legal or HR reason, involve your attorney before you start deleting. Keeping a mailbox for a defined period is normal. Reading through someone's personal messages is a different decision, and it is not an IT decision.

Write It Down Once

The checklist should be one page, stored with the job description and the offer letter. When the next departure happens, nobody has to invent the process under time pressure.

A provider of managed IT services in Central PA usually runs this list as a standard request, with a form the manager fills in. A provider of cybersecurity services in Central PA can also review who still has access afterward, which is the check that catches what the checklist missed.

The Test

Ask yourself one question: if this person signed in tomorrow, what could they see? If the answer is anything more than nothing, the offboarding is not finished.

If you want help building the checklist or running it, call BlackCSI at (717) 620-3042 or get in touch. We will make sure the door is actually closed.