An employee IT offboarding checklist helps a business protect its systems without losing the files, conversations, and service ownership needed to keep work moving. The process is more than disabling an email login: it should cover remote access, cloud apps, devices, shared files, and accounts tied to the employee’s contact information.
Plan the work with the appropriate manager and whoever administers your technology. For a routine departure, coordinate around the agreed last working time. If a departure is involuntary or there is a specific security concern, coordinate the timing and access changes with the people responsible for the separation. Avoid relying on a single checklist if your organization has additional recordkeeping or security requirements.
Before the employee’s last day
Make an account and access inventory
Start with the systems the employee uses, administers, or can reach remotely. Check more than the main work account. Depending on your environment, the inventory may include:
- Work email, identity or single sign-on accounts, and cloud storage.
- Business applications, customer or case-management systems, and finance or payroll tools.
- VPN, remote desktop, remote support, network equipment, and administrator access.
- Password managers, authentication and recovery methods, security keys, and multi-factor authentication devices.
- Vendor portals, website administration, social accounts, domain services, and software subscriptions.
- Shared credentials, API keys, automated jobs, and systems registered to the employee’s email address or phone number.
- Building access, badges, business phones, voicemail, and any other work-related access method.
Ask the employee’s manager and the people who handle technology to check for less visible access, such as vendor accounts or a shared mailbox they manage. The CISA account security checklist can also help you review account controls and access practices.
Protect continuity before changing ownership
Identify the employee’s active work, upcoming customer communications, shared folders, recurring tasks, and vendor relationships. Assign a new owner for each item that needs follow-up. Confirm that important files are stored in an approved business location rather than only on a personal desktop or in an individual account.
Decide how the business will handle the employee’s mailbox and files. If others need access, arrange an appropriate handoff or delegation. Preserve business records according to your organization’s retention and records-handling requirements; do not assume that deleting an account is the same as completing the recordkeeping process. For public-sector organizations handling public records, consult the applicable records officer and Florida’s records management FAQ for relevant guidance.
For a broader plan for keeping essential work going through a disruption, see this guide to business continuity planning for Northeast Florida companies.
At the agreed separation time
Disable access and secure accounts
At the planned time, disable the employee’s sign-in access across the systems in your inventory. Revoke active sessions and remote access where available, and remove access to cloud applications, VPNs, vendor portals, and administrative tools. Review authentication and recovery methods so the former employee cannot use a personal phone number, recovery email, or security key to regain access.
If the employee had access to shared credentials, change the credentials that are still needed and update them in the approved password manager. Review API keys and other non-person accounts they created or maintained. Transfer ownership or replace those credentials where appropriate; simply disabling a person’s login may not affect an integration or service account.
Keep a record of what was disabled, transferred, or left active with a reason and responsible owner. If an account cannot be closed immediately because it supports an ongoing business process, limit access, assign someone to resolve the exception, and track it to completion.
Collect company equipment and access items
Use a written return list tailored to the employee’s role. It may include a laptop, phone, tablet, charger, security key, removable storage, badge, keys, and other company-owned equipment. Record what was returned and note any item that is missing or needs follow-up.
For returned devices, confirm the business has the files and information it needs before resetting or reassigning the equipment. Follow your normal device-management process for removing business accounts, securing company data, and preparing the device for its next use.
Handle personal devices carefully
If the employee used a personal device for work, identify which company accounts, applications, or managed work areas were used. Remove business access and company data using your established process, while taking care not to erase personal information. If you cannot separate the work data from personal data confidently, pause and get appropriate technical and management guidance rather than wiping the entire device.
After departure
Confirm the handoff works
Have the new owner confirm they can reach the business files, mailbox or shared resources they need, and the vendor or service accounts they now manage. Check that customer communications, recurring tasks, scheduled jobs, and support arrangements have a responsible owner. Verify that removing the employee’s access has not interrupted a process the business still depends on.
Review the access inventory for overlooked accounts, especially those hosted by outside vendors or tied to an individual email address. Close, transfer, or update them as appropriate. Document any remaining exceptions and set a follow-up owner.
Keep an offboarding record
Keep a concise record of the departure-related technology actions: the access reviewed and removed, equipment returned, business data preserved or transferred, unresolved exceptions, and who completed or approved the work. Store the record according to your organization’s process and limit access to people who need it.
If you are preparing for a cyber insurance renewal, compare your records with your policy’s specific security conditions and evidence expectations. Ask your broker or insurer how to handle any questions about the policy or reporting process. A completed checklist is useful documentation, but it does not by itself establish insurance coverage. This cyber insurance renewal evidence checklist can help you organize related records.
Make the process repeatable
Keep one offboarding procedure that can be adapted to the person’s role, systems, and circumstances. Make ownership clear: someone should coordinate the checklist, someone should carry out technical access changes, and the employee’s manager should identify work and records that need a new owner. Review the process when your systems or internal responsibilities change.
Zevonix provides managed IT, cybersecurity, backup and disaster recovery, and help desk support for businesses in Northeast and Central Florida. If your team needs help coordinating account access, devices, or continuity tasks, learn about local IT help desk support or contact Zevonix at (904) 658-0777.