Employee offboarding security checklist
A departure should trigger a coordinated review of accounts, sessions, devices, shared access and business records. The right sequence depends on the person’s role, system behavior and applicable retention instructions.
Minnesota based · Preparing for launch · Scope agreed before work begins
What should happen to access when someone leaves?
Apply the answer to your business
Removing email access alone may leave a former staff member in a project application, password vault or file-sharing group. Start with the agreed inventory and identify the people responsible for each system.
This is an illustrative situation, not a reported CX client engagement.
Turn the question into a next action
Choose the business decision you need, involve the person responsible for the system and record what is known versus what needs validation. Keep the follow-up small enough that it has a named owner and a clear finish line.
- Ask your teamWhich applications and shared groups did the person use?
- Ask your teamWho confirms that access changes are complete?
- Ask your teamWho decides how business files and devices are handled?
Evidence to bring to the conversation.
Use the agreed scope to decide which records are relevant. These items can help the business and technical owners establish a common starting point:
- An approved departure checklist
- System-owner completion records
- Business decisions about data and device custody
Missing evidence is an open question to document. It is not a reason to invent an answer or assume that the underlying system is protected.
Know the boundary
Account removal and record retention can have operational and legal consequences. Coordinate with HR, the business owner and the appropriate advisers rather than using a generic deletion rule.
Published by CX Cyber Security · General education · Updated October 31, 2026. Further reading: NIST: multi-factor authentication and account access. CX’s original guide is not a NIST assessment or endorsement.
Plan your next step
Start with the business.
Get clear on the risk.
Tell us what your company does, the size of your team and what prompted your enquiry. We’ll discuss fit and the scope needed before proposing work.
Preparing for launch. Enquiries are welcome; delivery dates and engagements require finalized onboarding and a written agreement. Please do not email passwords or sensitive security evidence.