Employee Offboarding IT Security Checklist for Removing Access Safely

A secure employee offboarding process involves more than disabling a login. An employee offboarding IT security checklist should cover system access, devices, company data and continuing contractual obligations. For standard accounts, revoke access no later than the employee’s last working day, coordinating the timing with HR and system owners.

It’s easy to focus on collecting a laptop and overlook email forwarding, apps outside single sign-on, shared credentials or files that still need an owner. A consistent process closes these gaps while keeping the departing employee’s work moving.

This guide explains employee offboarding and the key security checks: removing access across systems, recovering company equipment, reviewing work and personal devices, and considering obligations such as non-disclosure agreements. It also explains why preserving business records and documenting completed actions matter. The goal is a clear handover that protects your organisation and keeps essential work moving.

Removing access from local accounts, SaaS, cloud and on-premises apps

Start with a current inventory, not an old staff list. Match the departing employee to directory accounts, application roles, devices and infrastructure permissions. Include local logins, SaaS tools, cloud consoles, VPN, remote desktop, Wi-Fi, SSH, customer databases, print-release systems and third-party portals. This broader view can reveal access that single sign-on does not control. Record each system, access level, owner and removal method in your employee offboarding IT security checklist.

• List every account and entitlement. Include apps without single sign-on or automated provisioning, since disabling the central identity may not close them.
• Revoke identity-provider and single sign-on access at the authorised cutoff. For standard accounts, complete access removal by the end of the employee’s last working day at the latest. Disable the primary identity and revoke active sessions, while preserving business data for handover.
• Remove access directly from individual services. Close email, VPN, cloud apps, remote access and vendor accounts. Check forwarding, delegated inboxes, OAuth grants, app passwords and recovery contacts. Remove personal recovery details and update multi-factor authentication methods.
• Rotate credentials the employee could use. Change shared passwords and revoke API keys, access tokens, recovery codes and SSH keys. Complete the full audit of API keys, tokens and SSH keys within 48 hours of departure.
• Monitor sensitive access during notice. For a sensitive-access resignation, Carnegie Mellon Software Engineering Institute guidance recommends reviewing activity logs for the 30 days before and after resignation. Check for unusual downloads, permission changes or account activity.

Automate offboarding by linking an authorised HR departure record to identity-provider actions and a task list for systems that require manual removal. Keep an audit trail of the cutoff, completed revocations, exceptions, owners and follow-up deadlines. Review recent sign-ins and security logs after access changes, then record final sign-off. Update the employee offboarding IT security checklist whenever systems, apps or account ownership change.

What is employee offboarding?

Employee offboarding is the controlled handover of a person’s access, responsibilities and company assets when they leave. It involves more than disabling a login: the process must maintain business continuity while preventing former employees from retaining access.

Start with an inventory linking the departing employee to assigned devices, accounts, applications, shared vaults, vendor portals and privileged roles. Include code repositories, service accounts and automated jobs. For example, a departing developer may own scheduled tasks. Transfer ownership and document dependencies before disabling the account, or a routine identity change could interrupt a critical service.

• Transfer code and operational ownership. Assign repositories, domains, automations and system administration to a named colleague, then confirm they have the permissions needed to maintain them.
• Disable identity-provider access and active sessions. At the agreed cutoff, block new authentication and revoke existing sessions through provider-side controls. This helps close active access, not just future sign-ins.
• Secure shared accounts. Change passwords for shared privileged accounts, revoke tokens and secrets the employee could access, and terminate sessions. Create new credentials where needed, then store them in the approved shared vault.
• Review administrator privileges carefully. Identify domain, system, cloud and application administrator roles. Reassign necessary duties, remove unnecessary privileges, and check that no account or service depends solely on the departing administrator.

UK GDPR requires businesses to control who can access their systems. For employment records, document the resignation or termination and preserve applicable legal holds, evidence-preservation steps and regulatory obligations before changing systems.

For business phone handovers, include assigned Business Mobile and Business VoIP accounts in the inventory, then transfer service administration to an authorised colleague.

Collect devices and check personal devices for company data

On the employee’s last day, compare the asset register with the equipment returned. Include laptops, phones, security passes, access cards, security keys and removable storage media. Record each item’s condition, serial number where available, and return status. A signed receipt provides a clear record of what the departing employee returned.

Recovering devices involves more than collecting hardware. Keep returned equipment secure, and don’t wipe it before IT considers whether business data or evidence must be preserved. Confirm who will assess, lock, reimage or prepare each device for reuse. If a laptop or phone contains critical work, preserve approved business records before repurposing it.

• Check the asset inventory. Match each assigned device and accessory against the employee’s record, then document missing or damaged items.
• Collect physical access items. Retrieve security passes, keys and access cards, and disable any active credentials linked to them.
• Review personal devices. Identify company email, files or other work data on personal phones and computers, then remove it through the organisation’s approved process.
• Secure returned equipment. Restrict access to recovered devices while IT checks for company data, damage or signs of a security incident.
• Follow up on missing property. Contact the relevant manager and departing employee, document each outstanding item, and follow up within 48 hours of departure.

On the final working day, confirm the authorised cutoff with HR, collect equipment and passes, record returned items, and disable active physical access. Keep the inventory and access record together so every action has a clear owner and status.

For storage media, retrieve company-owned drives and other removable devices alongside the laptop. Record each item, restrict access during assessment, and preserve required business data before securely sanitising or reusing the media. Reconcile outstanding equipment again 30 days after the employee’s last day.

Checking contractual obligations such as non-disclosure agreements

Access removal protects systems, while contractual obligations govern what happens after an employee leaves. Before the final day, identify the signed employment agreement, any non-disclosure agreement (NDA), and relevant confidentiality clauses. Remind the departing employee of continuing duties, using the wording in their documents rather than a generic statement.

• Locate the applicable documents. HR should identify signed agreements, amendments and policies covering confidential information, intellectual property and company records.
• Explain the practical boundaries. Clarify that business information must not be shared or retained outside approved processes. Use examples such as customer lists, pricing files, source code and internal reports.
• Confirm the handover route. Identify work files, applications and projects that need transfer to a new owner. Preserve required business records through approved company systems instead of asking the departing employee to forward them to a personal account.
• Address personal copies and downloads. Include company files downloaded to personal devices or stored in personal applications in the handover discussion. Arrange removal through the organisation’s approved process, while preserving records that must remain available.
• Record the conversation. Note which documents were reviewed, what guidance was given and any outstanding questions. Keep the record with the relevant offboarding documentation, limiting access to appropriate staff.

Make the reminder relevant to the person’s role. A software developer may handle source code and repository access, while a sales employee may hold customer information or account notes. Explain how to report accidental retention or disclosure, and direct questions about agreement wording to the appropriate HR or legal contact. Don’t claim an NDA covers information or conduct unless its terms support that interpretation.

Complete this review before access ends, then coordinate it with the final handover. A clear, documented discussion helps the employee understand their continuing responsibilities without replacing the agreement itself. For help aligning security controls with employee departures, discuss a secure offboarding process.

Cornerstone Business Solutions: Cyber Security

Cornerstone Business Solutions helps businesses strengthen security controls and manage the IT systems involved in employee departures. Its Cyber Security and Managed IT Support can support a more consistent approach to access, devices and business data, including Microsoft 365 accounts used by departing employees.

When manual handovers leave uncertainty about account ownership, access removal or protecting company information, a structured process can help. Cornerstone Business Solutions provides a whole service solution for IT support and related technology needs, connecting security checks with day-to-day IT management so your team can handle transitions more clearly.

To discuss your organisation’s offboarding security and IT support, contact Cornerstone Business Solutions.

Make secure departures part of everyday IT

Make the employee offboarding IT security checklist a repeatable process, not a document used only when someone leaves. Assign an owner to each action, align the process with HR notifications, and update it when systems or responsibilities change. This makes departures easier to coordinate and reduces reliance on one person’s memory.

Use each departure to improve the process. Note where ownership was unclear, a manual account needed extra attention, or a handover interrupted work. Update the relevant procedure to make the same gap less likely to recur. Keep access decisions and records consistent with your organisation’s security practices.

For support shaping a more coordinated approach, contact Cornerstone Business Solutions. A considered process gives your team a clear path through each transition and helps you move forward with confidence.

Frequently Asked Questions

What Is the Offboarding Process?

Offboarding coordinates an employee’s departure across HR, their manager and IT. It establishes who approves the exit, who owns each handover, and how completed actions are recorded. For example, a manager can identify pending client approvals while IT handles system changes. Clear responsibilities help ensure business tasks are not overlooked alongside security controls.

What are the key takeaways?

Treat an employee’s departure as both an access change and a business transition. Decide who can approve exceptions, where handover records belong, and how unresolved tasks will be tracked. If a departing employee owns an approval workflow, for example, name a replacement before the workflow stalls. Clear ownership makes the process easier to repeat and review.

What are the most common offboarding mistakes?

Common mistakes include relying on a single notification, overlooking work dependencies and assuming that closing an account completes every handover. For example, removing an employee from a team without reassigning a client approval queue or recurring report can disrupt work. Unclear ownership of an exception creates another gap. Assign a responsible person and record the next action whenever a departure task cannot be completed immediately.

What are the security risks of incorrect offboarding?

Poorly managed offboarding can leave a route to business information or disrupt essential operations. An overlooked approval account could allow inappropriate changes, while an untransferred process could delay customer work. Risk also arises when teams cannot establish what happened after a departure. Traceable decisions and exceptions help an organisation investigate unexpected activity and distinguish authorised handover work from actions that need review.

What is an employee exit checklist?

An employee exit checklist is a working record of departure tasks, owners and completion status. It can cover HR approval, a manager’s handover, IT actions, company property and continuing responsibilities. Tailor it to the role: a team leader may need to transfer project decisions, while an administrator may need operational duties reassigned. Record exceptions and who will resolve them.

What’s the difference between unsecured and secure IT offboarding?

Unsecured IT offboarding relies on informal assumptions, such as expecting a manager to remember every task or believing one account change covers all systems. Secure offboarding assigns responsibility, coordinates actions and retains evidence of decisions. It also plans for continuity, allowing colleagues to take over essential work without preserving unnecessary access for a former employee.

Tags: access management, account deprovisioning, Data Protection, device recovery, employee handover, Employee Offboarding, IT Security, SaaS security