Cybersecurity
The "Insider Threat" You Overlooked: Proper Employee Offboarding
A lax employee offboarding checklist is a critical security gap. When a team member leaves, their digital access does not automatically disappear. Neglecting a formal IT offboarding process can lead to data theft, sabotage, and compliance nightmares.
Imagine a former employee, maybe someone who didn't leave on the best terms. Their login still works, their company email still forwards messages, and they can still access the project management tool, cloud storage, and customer database. This isn't a hypothetical scenario; it's a daily reality for many small businesses that treat offboarding as an afterthought.
Many businesses don't realize how much access departing employees still have. When someone leaves, every account, login, and permission they had must be carefully revoked. If offboarding is disorganized, it creates an "insider threat" long after the employee is gone. The risk isn't always malicious. Often, it's simple oversight. Old accounts can become backdoors for hackers, forgotten SaaS subscriptions continue to drain funds, and sensitive data may remain in personal inboxes.
The Hidden Dangers of a Casual Goodbye
A handshake and a returned laptop aren't enough to complete offboarding. Digital identities are complex, and employees accumulate access points over time: email, CRM platforms, cloud storage, social media accounts, financial software, and internal servers. Without a proper checklist, something is bound to be missed.
Former accounts are prime targets for attackers. A breached personal credential might match an old work password, giving a hacker trusted access to your systems. Access left behind by former employees is a significant and often overlooked vulnerability.
The Pillars of a Reliable IT Offboarding Process
A robust IT offboarding process is a strategic security measure, not just an HR task. It needs to be fast, thorough, and consistent for every departure, whether voluntary or not. This process should begin before the exit interview, with close coordination between HR and IT.
Your Essential Employee Offboarding Checklist
Disable network access immediately. Once an employee leaves, block sign-in to their primary account, revoke VPN access and any remote desktop connections, and remove their registered MFA methods. In Microsoft 365, also revoke the user's active sessions, because blocking sign-in does not immediately end sessions that are already open on a phone or laptop.
Reset passwords for shared accounts. This includes social media accounts, departmental email boxes, and shared folders or workspaces.
Revoke cloud access. Remove permissions for Microsoft 365, Google Workspace, Slack, project management tools, and other platforms. Using a single sign-on (SSO) portal makes it easier to manage access centrally.
Reclaim all company devices. Have the employee return all devices and perform secure data wipes before reissuing. Don't forget mobile device management (MDM) to remotely wipe phones or tablets.
Handle the mailbox deliberately. Give the employee's manager or replacement access to incoming mail for 30 to 90 days, for example by converting the mailbox to a shared mailbox, which in Microsoft 365 usually does not need a paid license. Before you archive or delete anything, check your retention obligations and any litigation hold. Records you must keep under HIPAA, the FTC Safeguards Rule, or your own retention policy should not disappear with the account, and in Microsoft 365 a deleted user's mailbox and OneDrive content are recoverable for only a limited time unless a retention policy or hold preserves them.
Review and transfer digital assets. Make sure critical files aren't stored only on personal devices, and transfer ownership of cloud documents and projects.
Check access logs. Review what the employee accessed in the days before leaving. Pay attention to whether sensitive customer data was downloaded.
The Visible Risks of Getting It Wrong
Data exfiltration poses serious compliance and financial risks. A departing salesperson could walk away with your entire client list, or a disgruntled developer could delete critical code repositories. Even accidental data retention on personal devices could create problems under HIPAA, the FTC Safeguards Rule, or state privacy laws, leading to costly penalties.
Beyond data loss, poor offboarding leads to financial leakage. Subscriptions to SaaS applications may keep billing the company long after an employee has left. When this accumulates, it's a sign of weak governance.
Treat every employee departure as a security drill and an opportunity to review access, clean up unused accounts, and reinforce your data governance policies. Don't let former employees linger in your digital systems.
Offboarding works best when it is planned from the first day of employment. See our guide on why employee offboarding starts at onboarding, and contact Cyber One Solutions to help you develop and automate an offboarding protocol that keeps your business secure.