Agree authority, timing and what must be preserved
The business, HR or other authorized decision-maker should define when access ends, who can approve changes and what records must be retained. Technical staff should not decide employment, privacy or retention obligations from a generic checklist. Applicable duties and agreements vary across countries and circumstances.
Identify a coordinator and a second trusted administrative route before changing a critical account. If the person is the only owner of hosting, a domain or an integration, preserve a legitimate way for the business to operate. A normal departure and a suspected hostile or compromised account may require different sequencing and escalation.
Build an access map beyond email
List identity providers, mail, WordPress, hosting, domain registration, cloud files, CRM, password vaults, source repositories, backup systems and relevant personal devices or delegated accounts. Include access granted through groups and shared roles. A person can have operational control without appearing as a named user in the website dashboard.
Record the intended business owner and which system actually controls each permission. Do not collect private passwords in the checklist. A reference to a managed secret and its authorized owner is sufficient for coordination. Mark unknown ownership or missing administrator access as a gap that needs a decision.
| System or access route | Decision to make | Evidence of completion |
|---|---|---|
| Primary account | Block, preserve or transfer through the supported process | Authorized status and access result |
| Sessions and devices | Which sessions, tokens and device access need action? | Provider-specific verification |
| Shared files and mail | Who takes ownership and which records are preserved? | Transfer or access record |
| Applications and secrets | Which grants, keys and jobs depend on the person? | Revocation or replacement plus function check |
| Domain, hosting and backup | Can the business administer and recover them? | Confirmed ownership and recovery route |
Separate blocking access from deleting data
Follow the platform's supported employee-removal workflow. Google Workspace and Microsoft 365 document different steps and implications for access and data. A suspension or sign-in block, session action, ownership transfer, licence decision and deletion are not interchangeable operations. Features and retention behavior can depend on the plan and configuration.
Agree what happens to mail, shared files and messages addressed to the departing person. Do not assume forwarding is appropriate or that deletion preserves a complete business archive. Use the relevant administrator documentation and authorized retention decision, and verify the resulting access without logging in as the former employee or reading unrelated personal material.
Review sessions, grants and credentials independently
A password change may not revoke every token, delegated permission, connected app or service credential. Use the provider's applicable controls and verify their scope. Review recovery email addresses and factors as well as the main sign-in path. An account that cannot sign in interactively may still be connected to a workflow through a different mechanism.
For a shared credential the person knew, identify authorized consumers before rotation. Replace it through an agreed change plan and check the business function afterwards. Do not paste the new value into the checklist. An integration should not silently remain owned by a departed individual simply because replacing it takes coordination.
Transfer the business function, not the person's identity
Move ownership or responsibility through supported administrative mechanisms. A generic shared login can make future attribution and removal harder. Where an appropriate service identity or delegated role is supported, define its owner and limits. A replacement employee should receive the access needed for their role, rather than inherit every permission the former account accumulated.
Check websites, forms, backup jobs, billing notices and supplier contacts that may depend on the account. If a replacement cannot be completed safely within the departure window, record a controlled temporary arrangement and a follow-up owner. Avoid keeping unrestricted access enabled without an explicit decision merely to prevent an automation failure.
Verify the result and preserve a useful handover
Use authorized administrative evidence and controlled checks to confirm the intended state. Record which roles or sessions were addressed, which ownership transfers completed and which functions were tested. Do not attempt a former employee's private account login to prove removal, and do not use real customer submissions as test data when a synthetic check will suffice.
Separate completed actions from unverified systems, supplier requests and exceptions. A concise handover should identify the decision-maker, operator, times, evidence references and remaining work. Protect the record: an offboarding map can itself reveal valuable information about the business even when it contains no passwords.
Review the process for the next departure
Unexpected dependencies reveal improvements for ordinary access management. Assign ownership when a new system is introduced, use appropriate roles and make recovery independent of one individual. The aim is a process that the authorized business can repeat, rather than a last-minute search through the departing person's inbox.
CyberFixCrew is an Israeli cybersecurity company serving worldwide businesses in website and digital-infrastructure work. We can clarify a scoped technical access review or implementation task; we do not make employment decisions or certify legal compliance. Describe the affected systems and timing without including private employee files or secrets in an initial enquiry.
