Employee Offboarding: IT Steps to Protect Your Data

Why Offboarding Is an IT Problem, Not Just an HR One

When someone leaves your company, the paperwork usually gets handled: final paycheck, benefits, an exit conversation. But the digital side—email, files, apps, passwords—often gets missed. And that's exactly where the risk hides.

A former employee who still has access to your systems is a serious liability, whether they left on good terms or not. They may still be able to read email, download files, or log into apps weeks after their last day. For a 5–50 person business on the South Shore with no dedicated IT staff, offboarding tends to happen in a rush, and gaps are easy to overlook.

The good news: a solid offboarding process is mostly a checklist. Once you build it, you follow the same steps every time. Here's what that looks like in plain English.

Start Before the Last Day

Good offboarding starts the moment you know someone is leaving. A few things are much easier to do while the person is still employed and cooperative.

• Make a list of everything they can access. Email, shared drives, accounting software, your CRM (the tool that stores customer contacts and deals), social media logins, the company bank portal, industry-specific apps—write it all down.
• Identify company data on personal devices. If they used a personal phone or laptop for work, note it. You'll need to remove company email and files from it.
• Plan for their files and email. Decide who inherits their projects and where their documents should live afterward.

Doing this early means the actual cutoff on the last day is fast and clean.

The Core Offboarding Checklist

When the employee's access should end—usually at the end of their last day, or immediately for a termination—work through these steps.

1. Disable the Account (Don't Delete It Yet)

Your first move is to disable, not delete, the person's main login. Disabling blocks them from signing in but keeps their email and files intact so you don't lose anything.

Most small businesses run on Microsoft 365 or Google Workspace. In both, an administrator can block sign-in in a minute. Deleting too soon can wipe important emails and documents you may need later.

2. Reset the Password and Sign Them Out Everywhere

Change the account password so old saved logins stop working. Then force a sign-out of all active sessions. This matters because someone can stay logged in on a phone or home computer even after the password changes. Both Microsoft 365 and Google Workspace have a "sign out everywhere" option.

3. Turn Off Access to Every Other App

This is where the earlier list pays off. Go through each app and remove the person's access:

• Accounting and payroll software
• CRM and sales tools
• Project management apps
• File-sharing services (Dropbox, OneDrive, Google Drive)
• Shared social media and marketing accounts
• Any vendor or supplier portals

Don't forget shared logins. If your whole office uses one password for a tool, change it—otherwise the former employee still knows it.

4. Handle Their Email the Smart Way

Email is one of the most sensitive areas. You want to keep receiving messages sent to their address without letting them read anything. A good approach:

• Convert the mailbox so it forwards to a manager or the person taking over their work.
• Set an auto-reply letting senders know who to contact now.
• Keep the mailbox archived for a period in case you need to search old messages.

Avoid the temptation to just delete the account. Customer conversations and important records often live in email.

5. Recover and Reassign Their Files

Make sure their documents are saved where the team can find them. If they stored work on their laptop's desktop or in a personal folder, move it to a shared location before you wipe the device. Transfer ownership of any shared files or folders to a current employee.

6. Collect and Wipe Company Devices

Get back every piece of company hardware:

• Laptop and desktop
• Phone and tablet
• Security fobs, USB drives, and access badges
• Any equipment taken home for remote work

Before reusing a device, wipe it (erase it completely) and set it up fresh. If the person used a personal phone for work email, remove the company account from it remotely so no company data lingers.

7. Update Building and Physical Access

IT and physical security overlap. Deactivate keycards, change door codes if they knew them, and remove them from the alarm system. If they had a key to your Braintree or Quincy office, get it back or rekey the lock.

8. Handle Multi-Factor Authentication

Many accounts use multi-factor authentication (MFA)—that second step where you approve a login on your phone. If the former employee's phone was the approval device for any shared or admin account, you need to reset that MFA so you're not locked out and they're not still the gatekeeper.

Special Care for Admins and Owners of Access

If the person leaving was your most tech-savvy employee—the one who "handled the computer stuff"—slow down and be thorough. They may control:

• The administrator account for your email system
• Your domain name registration (where your website and email addresses live)
• Passwords to critical vendor accounts

Losing control of these can be far more damaging than a regular employee's departure. Make sure ownership and admin rights are transferred to someone you trust before their access ends. This is a common blind spot, and a managed IT provider will map these out so nothing critical walks out the door.

Keep a Record

Document what you did and when. A simple offboarding log—date, employee, steps completed, who did them—protects you. If a question comes up later about whether access was removed, you'll have an answer. Cyber insurance providers and clients increasingly expect this kind of basic diligence.

A Simple Timeline

• Before last day: Inventory access, plan file and email handoffs.
• Last day: Disable account, reset passwords, force sign-out, remove app access, collect devices.
• Within a week: Wipe and reassign devices, confirm email forwarding works, update physical access, finish the log.
• After 30–90 days: Once you're sure nothing important is needed, fully delete or archive the account.

Where Elecrics Fits In

Most small businesses can handle onboarding and offboarding themselves with a good checklist—but the technical steps (admin accounts, MFA, device wipes) are exactly the ones that get skipped when everyone's busy. A managed IT provider builds a repeatable offboarding process and can run it the same way every time, so a departure never leaves a door open.

If you're a business on the South Shore and you're not confident that former employees are fully locked out of your systems, we'd be glad to help. Book a free 20-minute IT Fit Call at https://elecrics.com/book and we'll walk through where your gaps are—no pressure, no jargon.