When Employees Leave: The IT Offboarding Checklist That Protects Your Data and Your Budget

Employee departures are routine. Unmanaged access is not.

When someone leaves, their accounts, devices, credentials, email, and business knowledge need a clear next owner. If even one step is missed, your company may face avoidable security exposure, disruption, or replacement costs. These are practical business IT risks, and a repeatable offboarding process helps you manage them.

This checklist focuses on the IT work that follows a departure: revoke access, recover equipment, handle email carefully, rotate exposed credentials, and hand over responsibilities. It is separate from a review of dormant software licences; the goal here is to close the access and continuity gaps created when a person leaves.

Prepare before the last day

Start when HR or the manager confirms the departure date. Assign an IT owner and a business owner for the handover. Decide who will coordinate actions, approve exceptions, and confirm completion.

Build an inventory of the employee’s access and assets. Check more than the main email account. Include:

• Identity and remote access: Microsoft 365 or Google Workspace, SSO, VPN, remote desktop, MFA devices, and recovery methods.
• Business applications: file storage, CRM, accounting, payroll, project tools, code repositories, and vendor portals.
• Privileged or shared access: administrator roles, password vaults, shared accounts, API keys, SSH keys, and service credentials the person may know.
• Devices and physical access: computers, phones, security keys, removable drives, badges, office keys, and any company data stored locally.
• Work that needs a successor: files, calendars, customer or supplier contacts, recurring reports, automations, and account or system ownership.

An HR checklist alone may not reveal every application or access path. Ask the manager and employee which systems they use, then compare that information with your account and asset records.

Revoke access at the right time

For an involuntary or sensitive departure, coordinate with HR and IT so access changes happen at the agreed separation time. For any departure, disable access promptly; do not leave accounts active while waiting for someone to remember them later.

At the separation point:

• Disable the primary identity account and application logins.
• Remove directory groups, admin roles, VPN access, remote access, and SSO access.
• Revoke active sessions and tokens where the system supports it.
• Remove MFA devices, passkeys, app passwords, recovery codes, and personal recovery email addresses or phone numbers.
• Remove delegated access to mailboxes, calendars, drives, shared channels, repositories, and business accounts.

NIST’s SP 800-53 personnel termination control calls for disabling system access and revoking associated authenticators and credentials when personnel leave. The practical lesson: removing a user from one central account may not close every route into your environment.

Don’t forget shared secrets

If a departing employee knew a shared password, or could retrieve it from a vault, remove their vault access and rotate the secret. Depending on what they could access, that may include shared administrator passwords, API keys, service-account credentials, SSH keys, or certificates.

Changing a person’s individual password is not the same as rotating a secret that several people use. Record what changed, who completed it, and where the updated credential is stored.

Recover devices and protect business data

Collect company equipment and record what comes back. Include laptops, phones, tablets, security keys, badges, removable media, and paper records. Note the asset ID or serial number, condition, return date, and person who received it.

If a device is missing or will not be returned, escalate it. Revoke its certificates or management access where applicable, and consider locking or remotely wiping it under your company’s device policy. If there is a suspected security incident, legal hold, or investigation, get the appropriate guidance before wiping or reimaging: preserving evidence may matter.

For returned equipment, confirm the disposition of business files before preparing it for reuse. Transfer or back up required data, remove the device from the former employee’s management profile as appropriate, securely erase it, and restore a clean, patched baseline before issuing it to someone else.

That sequence protects your budget as well as your data: a recovered, properly prepared device may be ready for reassignment instead of an unplanned replacement.

Handle email and records deliberately

Do not delete the employee’s account as the first step. Decide what business records must be retained, who needs access to work-related correspondence, and whether any retention or legal hold applies. Preserve records according to your organization’s policies and applicable requirements.

If email continuity is needed, choose a controlled option, such as mailbox access for a designated successor, an appropriate shared mailbox setup, or a limited auto-reply. Forwarding should have a clear business reason, a responsible owner, and a defined duration. Avoid silently sending all messages to another person without considering privacy, confidentiality, and your legal obligations.

Microsoft’s guidance for handling a former employee’s email describes options for forwarding or converting a mailbox. Follow the product steps that fit your setup, and make the decision before deleting the account.

Also check for mailbox rules, delegates, external forwarding addresses, and app connections that should not remain. Remove the departed employee from distribution lists, shared mailboxes, customer-facing contact routes, and password-reset notification paths. Update your website, CRM ownership, voicemail, and escalation contacts so customers and suppliers reach a monitored business channel.

Transfer ownership and knowledge

A secure account closure can still leave a business in a bind if no one knows where the work lives. Before access is removed, or as part of a planned handover, identify and transfer:

• Active projects, customer and supplier relationships, and upcoming deadlines.
• Business files, shared folders, calendars, and team documentation.
• Ownership of forms, automations, scheduled tasks, repositories, websites, domains, and vendor accounts.
• Instructions for recurring processes, reports, and system-specific tasks.

Name a continuing owner for each item. “The team has it” is not an assignment. A short handover document with links, owners, and next actions can prevent a slow computer or inaccessible account from becoming a larger operational delay.

Verify, document, and follow up

Use a ticket or written record to show that the work is complete. For each action, capture the system, action taken, date and time, administrator, verification result, and any exception. Have a second person review high-privilege or higher-risk departures where practical.

Before closing the offboarding task, verify that:

• Sign-in, VPN, and remote access are denied.
• MFA methods, sessions, and relevant credentials are revoked.
• Shared secrets known to the former employee have been reviewed and rotated as needed.
• Devices and physical access items are returned, secured, or escalated as missing.
• Email, files, and records have an approved disposition and a continuing owner.
• Delegated access, forwarding, and business contact routes are updated.
• Important work and account ownership have been handed over.

Schedule a follow-up review after the departure. Check for delayed vendor deprovisioning, unexpected sign-ins, forgotten access, and unresolved device or ownership issues. Make the timing fit your risk and systems; the key is to assign an owner and not treat the initial checklist as the final check.

For an involuntary separation, suspected misconduct, or a possible compromise, coordinate with HR and your security or legal advisors. Preserve relevant records and follow your incident-response process. Email monitoring, mailbox access, device inspection, and data retention can raise privacy and employment considerations, so apply your policies and applicable law.

Make the process repeatable

The most useful checklist is one your team can follow under pressure. Keep an up-to-date inventory of accounts and devices, define who must notify IT when an employee leaves, and set a response time that matches your risk. Review the process periodically and revise it when your systems or responsibilities change.

Need to estimate the cost of disruption if a system or employee handover stalls? Try our interactive IT Downtime Cost Calculator: URL pending. We are also preparing a Shadow AI Risk Self-Assessment. URL pending. These are clearly marked placeholders; live URLs are pending.

For current clients, the PWP SYSTEMS Support Portal provides a place to access support and submit tickets, view Huntress cybersecurity reports, and manage technology. Use the client portal to stay connected with your support resources. A consistent process, reliable records, and clear ownership help you protect company data, and keep the next workday moving.

---

Sonny’s companion cheat sheet: IT offboarding

Suggested PDF title: Employee Departure? Close the IT Gaps.

Key message: Disable access, recover devices, protect records, and transfer ownership, then verify.

Checklist panels:

1. Prepare: Confirm departure time, assign HR/IT/business owners, inventory accounts, devices, shared secrets, and work to transfer.
2. Revoke: Disable accounts, SSO, VPN, remote access, sessions, MFA methods, and delegated access. Rotate shared credentials the employee knew.
3. Recover: Collect and record devices, badges, keys, security tokens, and removable media. Escalate missing equipment.
4. Preserve and hand over: Decide email and records disposition; transfer files, calendars, customer contacts, automations, and system ownership.
5. Verify: Test that access is denied, confirm device and credential actions, document exceptions, and schedule a follow-up review.

Closing reminder: Don’t delete first and investigate later. Preserve required records, assign owners, and follow your company policies and applicable requirements.

Visual direction: Use a deep navy and electric-blue palette. Keep the panels readable, use simple checklist icons, and avoid suggesting the portal automatically performs offboarding.

CTA: Visit the PWP SYSTEMS Support Portal for client support and ticket submission.