Employee Offboarding Checklist

What's included

• Same day - accounts & access - disabling the user account, revoking MFA and VPN access, removing from email distribution lists, and pulling access from every system the person touched, not just the obvious ones.
• Same day - equipment - collecting laptops, phones, badges, keys, and any other company hardware before the person leaves the building, or arranging prompt return if remote.
• First week - setting up an email auto-forward or auto-reply if needed, reassigning open tasks, and confirming no shared logins or personal devices still have lingering access.
• Within 30 days - transferring file and mailbox ownership, archiving or deleting the account per your retention policy, and a final access audit to confirm nothing was missed.

Why this matters

Offboarding gets far less attention than onboarding, which is backwards - the security risk runs the other direction. An employee who leaves on bad terms with an account that's still active, or a departing contractor whose laptop was never wiped, is a far more common cause of a data incident than any outside attacker. The gap between "someone left" and "every one of their accounts is actually disabled" is exactly where these problems live.

A written checklist takes the decision-making out of a moment that's often emotional or rushed - a termination, a resignation, a layoff - and replaces it with a process that happens the same way every time, regardless of the circumstances.

How to use it

Treat the "same day" section as non-negotiable, even for amicable departures - access removal should never wait on paperwork or goodwill. Assign an owner before the departure is final, not after. Keep completed checklists on file as evidence that access was revoked properly, which matters for security reviews, cyber insurance, and compliance audits alike.