Employee IT Offboarding Checklist

Quick answer: IT offboarding should disable the departing person’s access at the agreed time, recover business devices, preserve required data, transfer ownership of shared work and review any credentials or services they could still use.

A staff departure can affect email, cloud files, customer records, phones, building access, websites and third-party services. HR, the manager and whoever manages IT should agree on timing and responsibility before the final day wherever possible.

Build an Access List

• Primary identity, email and multi-factor methods.
• Business computers, phones, tablets and security keys.
• Cloud storage, finance, CRM, job-management and communications tools.
• Website, domain, hosting, advertising and social accounts.
• VPN, remote support, Wi-Fi, alarm and physical-access systems.

At the Agreed Time

• Block sign-in or remove access according to the approved plan.
• Revoke active sessions, app passwords and recovery methods where supported.
• Recover devices, accessories, keys and records.
• Transfer ownership of files, mailboxes, calendars and workflows.
• Change genuinely shared secrets and vendor contacts.

Close and Verify

Do not delete the account before retention, legal, payroll and operational needs are understood. Record who completed each step, then check for dormant access, forwarding rules and unmanaged copies of data.

Practical note: Offboarding timing can be sensitive. Follow authorised HR or management instructions and applicable workplace, privacy and record-retention obligations.

Sources & Further Reading

• Australian Cyber Security Centre: Small Business Cyber Security

This guide provides general information, not a diagnosis, guarantee or substitute for advice based on your specific devices, systems, contract or site. Confirm scope, inclusions and pricing before making a service decision.