Start the Conversation with Sentrix
Submit your email and a member of our team will be in touch with you.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Employee offboarding is often treated as an administrative task. Someone leaves, HR updates the records, a laptop is collected, and the team moves on. From a cybersecurity point of view, that is not enough.
When an employee leaves, you are closing access to systems, files, email, devices, and customer data. If the process is rushed or inconsistent, a former employee may still reach business information after their last working day through active passwords, email forwarding, or unchecked devices and applications.
Offboarding does not need to be complicated. With a clear process, you can protect data, reduce stress, and avoid mistakes during a busy handover period. Act in the right order and record every change.
Offboarding matters because it is one of the few times you know, with certainty, that a person should no longer have access to your business systems. That makes it a good time to review and remove access before it gets forgotten.
If you wait, even for a short period, there can be a gap between the person leaving and their access being removed. That gap may be harmless, but it may also give someone a route into email, client records, cloud storage, finance tools, or internal applications they should no longer use.
Check more than the main user account. Depending on the role, they may also have access to shared mailboxes, team folders, CRM, accounting software, project tools, and supplier portals. They may also have downloaded files or stayed signed in on a personal phone.
For SMEs without dedicated IT staff, this is where problems often arise. The same password may have been used in several places, permissions may have been given informally, and one person may assume that somebody else has handled the exit. A short conversation is not a reliable security process.
We recommend treating offboarding as a structured process. The outcome depends on taking the first actions quickly and recording each change, so begin with a clear order of events.
Start by removing access to the systems the employee uses most as soon as their departure is confirmed. A resignation can be planned for, but an unexpected departure needs the same controls immediately.
Start with identity and access. Disable or suspend the user account in your main systems, then review connected tools that use the same identity. Single sign-on can help, but some applications still hold their own sessions or cached access.
Review active sessions as well. A password reset may not end an existing login on every device, so where possible, sign the user out of email, cloud storage, collaboration tools, and remote access platforms.
If the employee had administrator rights or access to finance, payroll, client, or security systems, treat the exit as higher risk. Remove those permissions before or at departure, rather than during a later review.
A practical offboarding checklist should cover:
A named person should own the checklist, with input from the business owner, line manager, and IT support where relevant. Clear ownership prevents steps being lost between departments. Once access is closed, focus on the devices, passwords, and permissions that may still connect the former employee to your business.
Start by recovering company devices. Laptops, phones, tablets, security tokens, external drives, and other equipment should be accounted for, and you should check whether business data was stored locally, synced for offline use, or saved in a personal folder.
If a device cannot be returned, consider whether it can be locked or wiped remotely, or whether another protective step is needed. Our managed IT and cybersecurity services can help you confirm what controls are available, but act promptly because a missing device may still hold business information.
Next, review passwords and shared accounts. If the departing employee knew a password used by more than one person, change it. Check shared email, social media, supplier portals, Wi-Fi, booking tools, document approval systems, and other accounts outside the main user directory.
Where possible, reduce shared logins. Individual accounts are easier to control, audit, and remove. If your team needs a shared mailbox, manage access through named user accounts rather than one password passed between colleagues.
MFA needs a separate check. Remove any linked phone, security token, or authenticator app, and revoke approval on personal devices. MFA only works if the registered devices and methods are kept up to date.
Permissions can create less visible risk. An employee may no longer need a folder, but group membership may still grant access. They may also have access to a project workspace, partner portal, website, hosting account, backup tool, or security platform that was never reviewed.
Pay particular attention to:
Email forwarding deserves care. It may help with continuity, but it should be approved, time limited, and reviewed. Unchecked forwarding can create privacy and security problems. A managed mailbox handover gives the business access to important messages without leaving unnecessary access in place.
Cloud storage needs the same discipline. Before an account is closed, make sure important files are preserved in a business location, rather than being left in a personal folder or on a device that may not be returned. These changes are easier to trust and repeat when they are captured in a clear record.
Offboarding is easier to manage when you can see what changed, when it happened, and who did it. A simple record gives you evidence if you need to investigate unusual activity or check how access was handled.
Your record does not need to be complex. For each departing employee, capture the essentials:
Note whether information must be retained for business, contractual, or legal reasons. Preserve what the business needs in an appropriate location while removing the former employee's access to it.
This balance matters when the employee managed customer records, contracts, financial information, or other sensitive data. Delete too much and you may lose useful records, while leaving too much in the wrong place may expose information unnecessarily. A controlled handover protects continuity and confidentiality.
A consistent record also makes future exits less stressful. If the former employee handled a supplier account, project folder, customer mailbox, or recurring process, the business should know where that information now lives and who is responsible for it. With the record in place, you have a practical starting point for strengthening the process and deciding where specialist support would reduce the workload.
For a small or medium-sized business, offboarding can feel like one more task on a full list. That is why it is worth formalising. A repeatable process reduces reliance on memory and helps your team respond when a departure is planned or unexpected.
We can review how you manage accounts, devices, passwords, permissions, email, and business data, then help create steps that fit your organisation. Our support may include an offboarding checklist, clearer account ownership, stronger MFA controls, device management, access reviews, and guidance on preserving business information.
The aim is to reduce the chance of something being missed when time is tight, without adding unnecessary administration. Your process should be clear enough for people to follow, detailed enough to protect important systems, and flexible enough to work across different roles and applications.
If your current approach relies on memory or email threads, contact us to find out more about how our IT and cybersecurity services can help you tighten the process. We can help you build a calmer, more consistent way to manage employee access so the handover is controlled and complete.