A team member leaves, but their name still owns the shared service inbox, the customer files, or a login used by the whole team. Closing access matters. So does making sure the next person can still do the work.
For a small business, employee offboarding is an operating process that joins people, systems, records, and physical property. A short employee offboarding checklist can help an owner remove access at the right time while keeping business work in company-controlled hands.
Security rules and employment requirements differ by country, industry, contract, and data type. The sources below describe US government guidance and examples. They are not universal legal deadlines. Follow the requirements that apply to your organization and get qualified advice when timing or record access is uncertain.
That is why employee offboarding should have a written owner and locally approved timing, rather than relying on an informal message to IT.
Give the process one owner and a clear trigger
A reliable employee offboarding process starts with a clear event, named coordinator, and approved effective time.
Name the person who coordinates each departure. That person can confirm the approved end date, notify system owners, collect company property, and track exceptions. Human resources, a manager, IT support, facilities, and the employee’s next owner may each have a task, but one coordinator should see whether the employee offboarding handoff is complete.
Use a different route for a transfer. A departing employee may need access disabled, while a person changing roles may need some permissions removed and others added. NIST’s guidance for organizations handling controlled unclassified information calls for reviewing access after a transfer and changing it to match the person’s operational need. That framework applies to its stated information-protection context. It is not a general law for every business.
Set the timing from approved company policy and the circumstances. CISA’s Cross-Sector Cybersecurity Performance Goals include a recommendation for critical-infrastructure organizations to disable departing employees’ accounts and return physical credentials by the day of departure. CISA describes the goals as voluntary guidance, not a universal legal deadline. Do not copy that timing into another country’s policy without checking the rules and needs that apply there.
Inventory access, property, and work ownership
Use the employee offboarding review to connect each important account with a responsible system owner and a continuing business need.
Employee offboarding works best when the company knows what the person can reach and what work they control. The list may include company email, file storage, finance or customer systems, remote access, administrative accounts, shared devices, vendor portals, physical badges, keys, and authentication tokens. A growing business may have accounts created outside its main identity system, so ask each team lead where work happens. This makes the employee offboarding process cover the real work environment, not only the central account directory.
Include ownership as well as login access. Identify the person who can respond to incoming customer requests, approve transactions, release a report, or renew a supplier service. Transfer company records and open work to an approved custodian before disabling an account when the departure process permits it. Retain and disclose records under the company’s policies and applicable requirements. Do not copy personal content or retain data without an approved reason.
Shared accounts deserve special attention. A common password can make it difficult to tell who performed an action, and former staff may still know it after their personal account closes. Where a service supports named users, give each person an individual account. If a shared credential must remain, assign a responsible owner and change it when an authorized departure process calls for that step.
Include these shared tools in employee offboarding even when they do not appear in the central identity directory.
Use a practical employee offboarding checklist
A useful employee offboarding checklist is a handoff control, not just an IT ticket. Keep it tied to the person’s role and the systems that hold active work.
- Confirm the event and effective time. Record whether the person is leaving, transferring, or changing duties. Have the authorized manager or HR contact confirm when actions should take effect.
- Assign the work. Name new owners for customer queues, approval tasks, shared records, recurring reports, and vendor relationships. Set a temporary owner if a permanent assignment needs more time.
- List accounts and credentials. Check the central account directory, important business applications, remote access, privileged accounts, vendor portals, and shared services. Include access controlled by outside providers.
- Change permissions at the approved time. Disable accounts that should end, remove unnecessary roles, revoke credentials where required, and return physical keys, badges, devices, or tokens. For a transfer, review continuing need instead of removing all access by default.
- Protect business records. Confirm that required company records and active work have a business owner. Follow retention, privacy, and employment procedures rather than leaving files in a former employee’s account or making an unapproved copy.
- Check systems that did not update automatically. A central identity change may not close a direct vendor login or a locally managed account. Ask the system owner to verify each important destination and record any exception.
- Keep a completion record. Record the responsible person, action, time, system, and unresolved exception. A short record helps the manager see whether the process finished without relying on memory.
Keep this employee offboarding checklist in a place that managers can reach, and make its exception route clear.
NIST’s National Cybersecurity Center of Excellence describes an identity-management example in which a termination notice starts a workflow to remove access and invalidate credentials across connected systems. Treat it as a reference design, not a guarantee that one HR notification will reach every tool in your company. A small organization can use a simple owner checklist if its software does not support automatic coordination.
Illustrative example: a shared inbox and customer files
Illustrative example, not a DBG360 client result. A small consulting firm has four employees. One person is leaving and owns the shared inquiry inbox, a folder of active client files, and a login for an outside billing service. The manager confirms the approved end time, assigns the open inquiries and records to a new owner, asks the billing-service administrator to remove the departing user’s access, and confirms the company laptop and badge are returned. The manager records which steps are complete and who will handle the billing access if the outside administrator replies later.
The point is to avoid two different failures: an account that remains active without a business reason, and work that becomes unreachable because its only owner left. The exact systems, retention steps, and timing depend on the organization’s policy and applicable rules.
Test the checklist before a departure is urgent
Testing employee offboarding in advance helps expose unclear ownership while there is time to fix the handoff.
Review the employee offboarding checklist with the people who handle departures and system access. Ask them to trace one ordinary transfer and one separation through the steps. Which systems have named owners? Which updates require a vendor? Which account has elevated access? Where will the next owner find open work? Use the answers to fix gaps before relying on the employee offboarding process during a rushed handover.
Review the checklist when the company adds a new system, changes its HR process, moves work to a provider, or changes its record-retention policy. Keep the list short enough for managers to use and detailed enough to show who confirms each important step.
DBG360 can help map the handoff between people, business records, systems, and service responsibilities, then clarify who owns each step and how to verify completion. If departures or role changes leave access and work ownership unclear, start a conversation with DBG360.
