IT Hygiene: Offboarding an Employee the Same Day

When someone leaves, the paperwork usually gets done on time. Payroll stops, benefits end, the badge gets collected. The accounts are another story. A mailbox stays active so someone can "check it for a while." A cloud app nobody remembered keeps working. The former employee's phone still syncs email for weeks.

Offboarding is one of the most basic pieces of IT hygiene, and one of the most commonly skipped. This post is a same-day checklist and the reasoning behind it.

Why same day matters

Most departures are friendly. That is not the point. An account that stays active after its owner leaves is an account nobody is watching. If the password was reused somewhere that later gets breached, or the person's personal device is compromised, the attacker gets a working login that no one will notice for a while.

There is also the less friendly case. Someone leaves on bad terms and still has access to the CRM, the shared drive, or the bank portal. You do not want to find out about that from a customer.

What the frameworks expect

Offboarding is not just good practice. Most frameworks name it:

• HIPAA Security Rule. 45 CFR 164.308(a)(3) includes termination procedures for ending access to ePHI when employment ends. It is an addressable specification, which means you must implement it or document why an equivalent approach is reasonable. For almost every practice, the answer is to implement it.
• FTC Safeguards Rule. 16 CFR 314.4(c)(1) requires access controls that limit authorized users to the customer information they need. Someone who no longer works for you needs none.
• CIS Controls v8.1. Control 5 covers account management, including disabling accounts promptly. Control 6 covers revoking access when it is no longer needed.
• NIST SP 800-171. Requirement 3.9.2 calls for protecting systems containing CUI during and after personnel actions such as terminations and transfers.

The same-day checklist

Run this the day the person leaves. If it is a termination, run the account steps during or right before the conversation, not after.

Identity and email

• Disable the primary account in your directory or Microsoft 365 or Google Workspace. Disable first; delete later.
• Revoke active sessions and sign the user out everywhere. Disabling a password does not always end a session that is already open.
• Remove or reset MFA methods tied to the account.
• Convert the mailbox to a shared mailbox or set up forwarding to a manager, if you need to keep receiving mail. Do not leave the original account active for this.
• Check for mailbox rules the user created, especially forwarding rules to outside addresses.

Business applications

• Remove access to line-of-business systems that do not use single sign-on: the EHR, the DMS, the ERP, payroll, banking, payer portals, vendor portals.
• Transfer ownership of files, shared folders, and cloud documents the person owned.
• Remove the person from approval workflows, especially anything involving payments.

Devices

• Collect company laptops, phones, tablets, and keys or badges.
• For personal phones with company email or apps, remove the company data through your device management tool.
• Note any company data that may have been on personal devices and how it was handled.

Shared secrets

• Change any shared passwords the person knew: Wi-Fi, alarm codes, shared admin accounts, vendor logins.
• Remove the person from the password manager and review which shared vaults they could see.
• If they held administrative access, review what they changed recently.

Records

• Write down what was removed, when, and by whom. A simple ticket with a checklist attached is enough.

The steps people forget

The obvious accounts are rarely the problem. These are:

• SaaS apps signed up outside IT. A marketing tool, a file sharing service, a scheduling app. A quarterly review of the apps connected to your email domain helps catch these.
• Vendor portals. Supplier sites, payer portals, manufacturer portals. These often use an individual's email as the username.
• Personal email forwarding. If the user had a rule sending messages to a personal address, that data has already left. Find out before it continues.
• Mobile sync. A phone with an active mail profile can keep pulling mail if the session was not revoked.
• Role changes. Someone moving from billing to the front desk should lose billing access. Internal transfers are offboarding too, just partial.

Make HR and IT one process

Most offboarding gaps happen because HR knows and IT does not, or IT finds out after the fact. Fix that with one trigger: when HR records a departure date, IT gets a ticket automatically or by a standing rule. For planned departures, schedule the account steps for the last day. For terminations, coordinate the timing directly.

Managers also need a role. They know which systems the person actually used, which is often a longer list than IT has on file.

Check that it worked

Once a quarter, compare your active account list against your current employee list. Any account without a matching current employee or approved service purpose should be explained or disabled. This is the same access review that HIPAA, the FTC Safeguards Rule, and NIST all expect, and it catches the offboarding steps that slipped.

For a deeper look at insider risk, see why your most trusted employee might be your biggest risk.

How we help

TRNSFRM helps clients turn offboarding into a documented process with a record of each step. If your current process lives in one person's memory, start with the free compliance checklist, or book a free 45-minute Compliance Gap Audit and we will look at your account hygiene with you. Our IT resilience framework explains how this fits with the rest of the basics.