Executive Summary
When an employee leaves, their access does not leave with them unless IT removes it. Forgotten accounts, company data on personal devices, and shared passwords are common ways former staff, or attackers who find a dormant login, end up inside business systems. This guide gives you a three-phase checklist, a sample request form, and the mistakes to avoid.
| Quick Facts | |
| Who is involved | HR, the departing employee’s manager, and IT (or your managed services provider) |
| When to start | The moment notice is given, or before the exit meeting for involuntary departures |
| Biggest risks | Lingering access, data leaving with the employee, unreturned devices, shared credentials left unchanged |
| Typical timeline | Plan before the last day, cut access on the last day, finish cleanup within 30 days |
Why offboarding deserves a process
Most small businesses have a solid onboarding routine: laptop ready, accounts created, welcome email sent. Offboarding is often an afterthought handled by whoever remembers. That gap matters because a former employee’s account is still a valid login, and valid logins are exactly what attackers want. Even a friendly departure can leave behind client data synced to a personal phone, a mailbox rule forwarding messages to a private address, or a cloud app that nobody remembered to remove.
A written, repeatable checklist removes the guesswork. It also protects the person leaving, the team that inherits their work, and the business’s compliance obligations.
The three-phase offboarding checklist
Phase 1: Before the last day (prepare)
| Task | Details | Owner |
| ☐ Open an offboarding ticket | Record last day and time, and whether the exit is voluntary or involuntary | HR |
| ☐ Inventory accounts and access | Email, VPN, cloud apps, line-of-business tools, shared drives, admin portals, social media | IT |
| ☐ Inventory company assets | Laptop, phone, badge, security keys, tokens, peripherals | IT |
| ☐ Decide who inherits what | Files, mailbox, client relationships, scheduled tasks | Manager |
| ☐ Schedule access removal | For sensitive exits, time it to the exit conversation | IT + HR |
Phase 2: The last day (cut access)
| Task | Details | Owner |
| ☐ Disable the primary account | Disable first, do not delete. Reset the password and remove MFA methods | IT |
| ☐ Revoke active sessions | Sign out of all devices, revoke app tokens and OAuth grants | IT |
| ☐ Remove remote access | VPN, remote desktop, SSO apps, third-party portals | IT |
| ☐ Secure the mailbox | Set an auto-reply, forward or share with the manager, check for forwarding rules | IT |
| ☐ Recover or wipe devices | Collect hardware; remote-wipe lost devices; remove company data from personal phones | IT |
| ☐ Rotate shared secrets | Shared passwords, API keys, Wi-Fi keys, alarm and door codes the person knew | IT + Facilities |
Phase 3: After they leave (clean up, within 30 days)
| Task | Details | Owner |
| ☐ Transfer data ownership | Move files, calendars, and shared documents before deleting anything | Manager |
| ☐ Review recent activity | Check 30 to 90 days of logs for bulk downloads, external sharing, new forwarding rules | IT |
| ☐ Reclaim licenses and seats | Reassign or cancel software and update billing | IT / Finance |
| ☐ Update records | Asset list, org chart, vendor contacts, domain registrar and other admin contacts | IT |
| ☐ Delete per retention policy | Remove the account only after the retention window ends | IT |
| ☐ Close the ticket | Manager and HR sign-off confirm every step is complete | HR |
Sample: offboarding request form
Keep the form short so people actually fill it in. Here is a simple version you can copy into your ticketing system:
| Field | Example entry |
| Employee / department | Jordan Smith, Accounting |
| Last day and time | Friday, 5:00 PM (voluntary resignation) |
| Manager and data inheritor | Alex Rivera |
| Systems to remove | Microsoft 365, accounting software, VPN, CRM, bank portal (view-only) |
| Company devices to return | Laptop (Asset #0142), phone, security key |
| Mailbox handling | Auto-reply for 30 days; share mailbox with manager |
| Special risks | Has the shared password for the payroll portal; rotate on last day |
| Common Mistakes to Avoid Deleting the account too early. You lose the mailbox, files, and logs you may need later. Disable first, delete after the retention window. Missing apps outside single sign-on. Marketing tools, social accounts, and vendor portals often have their own logins. Leaving company data on personal phones. Without device management, email and files may stay in the employee’s pocket. Forgetting shared credentials. If three people know a password, everyone who leaves is a reason to change it. No clear owner. If HR assumes IT will handle it and IT never hears about it, nothing happens. |
How this maps to real attacker behavior
| MITRE ATT&CK technique | ID | Why offboarding matters |
| Valid Accounts | T1078 | A dormant account is a ready-made way in |
| Email Collection: Email Forwarding Rule | T1114.003 | Forwarding rules can quietly keep copying mail after departure |
| Data from Cloud Storage | T1530 | Leftover access to shared drives exposes company files |
| Exfiltration Over Web Service | T1567 | Unmanaged personal accounts and sync tools make data easy to move out |
| Pro Tip: Audit your accounts quarterly Compare the list of active user accounts against the current HR roster every quarter. Any account without a matching employee is a gap to close. Most gaps are found this way, not by the checklist. |
| Need help building an offboarding process? AvantGuard’s IT and Managed Services teams can turn this checklist into a repeatable workflow, with account removal, device recovery, and data protection handled for you. Stay secure and innovative. Web: www.avantguard.it | Email: info@avantguard.it |
