Employee Offboarding: IT Steps to Protect Your Data

Why offboarding is an IT problem, not just an HR one

When someone leaves your company — whether they quit, retire, or are let go — the paperwork usually gets handled. The final paycheck goes out, benefits get sorted, and maybe there's an exit interview. But there's a quieter risk that often slips through the cracks: all the digital doors that person still has keys to.

Think about it. A single office manager at a 20-person South Shore firm might have the passwords to your email, your file storage, your accounting software, your social media, and maybe even the Wi-Fi router. If none of that gets locked down when they walk out, those keys are still live — sometimes for months.

Most data incidents involving former employees aren't dramatic hacks. They're mundane: a login that was never disabled, a file synced to a personal laptop, a shared password nobody thought to change. The good news is that offboarding is very manageable once you have a repeatable checklist.

Do this before their last day (when possible)

If a departure is planned, you have the luxury of preparing. The goal is to be ready to flip the switches the moment they're gone — not scramble afterward.

• Make a list of every account they can access. Email, file storage (like Microsoft 365 or Google Workspace), accounting software, your CRM, payroll, banking, social media, website admin, and any industry-specific apps.
• Note what they "own." Are they the admin on any account? Do they own shared files, calendars, or email groups? Those need a new owner.
• Plan the email handoff. Decide who receives their incoming email and how long you'll keep the mailbox active.
• Coordinate timing with HR. For involuntary departures especially, IT access should be cut at the same moment the person is informed — not before, not hours later.

A note on sensitive terminations

If you're letting someone go and there's any concern about how they'll react, access should be disabled during the conversation, not after. This isn't about assuming the worst — it's basic risk management. A managed IT provider can quietly stand by to disable accounts on your signal.

The core offboarding checklist

Here's the sequence to run on (or just before) the person's last working moment. Walk through it top to bottom.

1. Disable their email and login accounts

Don't delete right away — disable. Deleting an account can erase files and email history you may still need. Disabling blocks access instantly while preserving the data. In Microsoft 365 or Google Workspace, this means blocking sign-in and resetting the password.

2. Revoke access on every other app

Go down your account list from the prep step. Remove the person from your CRM, accounting software, project tools, and anything else. Watch for apps that aren't tied to your main login system — those are the easiest to forget.

3. Turn off remote and VPN access

If the employee worked from home or on the road, they likely had a VPN (a secure tunnel into your network) or remote-access tools. Disable these so they can't reach your systems from outside after leaving.

4. Change shared passwords

This is the big one people skip. Any password the departing person knew — the Wi-Fi password, the shared social media login, a generic "info@" mailbox, the alarm code — should be changed. Even if you trust the person completely, a shared password that lives in someone's memory is no longer under your control once they leave.

This is also a great reason to use a password manager (a secure app that stores and shares logins), so you're rotating one entry instead of hunting through sticky notes.

5. Reassign or forward their email

Set up email forwarding or convert the mailbox to a shared mailbox so customers emailing the old address still reach someone. A common approach: forward to a manager for 30–90 days, then retire the address.

6. Recover and preserve their files

Make sure their documents live somewhere the company controls — not just on their laptop or a personal cloud folder. Transfer ownership of shared files and folders to a manager or teammate before the account is deactivated.

7. Collect company devices

Get back the laptop, phone, security key, badge, and any accessories. Note the condition and serial numbers. Don't wipe the laptop until you've confirmed nothing important only exists on it.

8. Remove them from company data on personal devices

Many employees read work email on a personal phone. If you use mobile device management (a tool that lets you manage company data on phones), you can remotely remove just the company data without touching their personal photos and apps. If you don't have that, at minimum ask them to remove the work email account and verify it's gone.

9. Update multi-factor authentication

Multi-factor authentication (MFA) is the extra code or prompt that confirms it's really you logging in. If the departing employee was the MFA contact for any shared account, move that to a current employee's phone or email — otherwise you could get locked out.

Don't forget these easy-to-miss items

• Autopay and billing accounts tied to their personal email or card.
• Domain and website logins — losing control of your domain is a nightmare to undo.
• Phone system / voicemail — reassign their extension and reset the voicemail PIN.
• Recurring calendar invites and meeting links they created.
• API keys or integrations they set up between apps (an MSP can help identify these).
• Group email aliases like sales@ or support@ that route to them.

Write it down once, reuse it forever

The single best thing a 5–50 person business can do is turn this into a standard checklist that lives in a shared document. Every departure is different, but 90% of the steps are the same every time. A written process means it still gets done correctly even when the person leaving was the one who usually handled IT.

Keep a simple log, too: date, employee, who ran each step, when devices were returned. If you ever carry cyber insurance or face a dispute, that record matters.

When to bring in help

If your business uses Microsoft 365 or Google Workspace, a managed IT provider can disable accounts, transfer files, wipe devices, and rotate passwords quickly and correctly — often within minutes of your request. That speed matters most during tense or sudden departures. Handling offboarding consistently is part of what day-to-day IT management covers; it shouldn't be a special project every time.

If offboarding at your Braintree, Quincy, Weymouth, or greater South Shore business currently relies on memory and good intentions, we're happy to help you build a process that runs the same way every time. You can book a free 20-minute IT Fit Call with Elecrics at https://elecrics.com/book — no pressure, just a straight conversation about protecting your data.