[{"data":1,"prerenderedAt":184},["ShallowReactive",2],{"publication:en:P052":3},{"meta":4,"copy":17,"relatedArticles":147,"terms":176,"term":177,"resourceParent":178,"glossaryParent":181},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P052","\u002Fblog\u002Femployee-offboarding-access","article","employee offboarding access checklist","Employee offboarding access checklist for small businesses","Employee offboarding access checklist for businesses","Remove a former employee’s access without losing business data: accounts, sessions, apps, secrets, shared files, ownership and verification. Plan provider-specific actions.",[13,14],"\u002Fservices\u002Faccess-2fa-audit","\u002Fservices\u002Fcorporate-email","2026-10-24","2026-10-30",{"intro":18,"sections":19,"checklistTitle":92,"checklist":93,"faq":100,"sources":110,"links":119,"cta":142},"An employee offboarding access checklist should preserve business ownership, end the person's authorized access and verify accounts, sessions, applications and secrets across relevant systems. Deleting a mailbox or changing one password is not a complete process. Agree authority, timing and data handling before making changes.",[20,25,57,69,74,82,87],{"title":21,"paragraphs":22},"Agree authority, timing and what must be preserved",[23,24],"The business, HR or other authorized decision-maker should define when access ends, who can approve changes and what records must be retained. Technical staff should not decide employment, privacy or retention obligations from a generic checklist. Applicable duties and agreements vary across countries and circumstances.","Identify a coordinator and a second trusted administrative route before changing a critical account. If the person is the only owner of hosting, a domain or an integration, preserve a legitimate way for the business to operate. A normal departure and a suspected hostile or compromised account may require different sequencing and escalation.",{"title":26,"paragraphs":27,"table":30},"Build an access map beyond email",[28,29],"List identity providers, mail, WordPress, hosting, domain registration, cloud files, CRM, password vaults, source repositories, backup systems and relevant personal devices or delegated accounts. Include access granted through groups and shared roles. A person can have operational control without appearing as a named user in the website dashboard.","Record the intended business owner and which system actually controls each permission. Do not collect private passwords in the checklist. A reference to a managed secret and its authorized owner is sufficient for coordination. Mark unknown ownership or missing administrator access as a gap that needs a decision.",{"caption":31,"headers":32,"rows":36},"Offboarding ownership and evidence record",[33,34,35],"System or access route","Decision to make","Evidence of completion",[37,41,45,49,53],[38,39,40],"Primary account","Block, preserve or transfer through the supported process","Authorized status and access result",[42,43,44],"Sessions and devices","Which sessions, tokens and device access need action?","Provider-specific verification",[46,47,48],"Shared files and mail","Who takes ownership and which records are preserved?","Transfer or access record",[50,51,52],"Applications and secrets","Which grants, keys and jobs depend on the person?","Revocation or replacement plus function check",[54,55,56],"Domain, hosting and backup","Can the business administer and recover them?","Confirmed ownership and recovery route",{"title":58,"paragraphs":59,"sources":62},"Separate blocking access from deleting data",[60,61],"Follow the platform's supported employee-removal workflow. Google Workspace and Microsoft 365 document different steps and implications for access and data. A suspension or sign-in block, session action, ownership transfer, licence decision and deletion are not interchangeable operations. Features and retention behavior can depend on the plan and configuration.","Agree what happens to mail, shared files and messages addressed to the departing person. Do not assume forwarding is appropriate or that deletion preserves a complete business archive. Use the relevant administrator documentation and authorized retention decision, and verify the resulting access without logging in as the former employee or reading unrelated personal material.",[63,66],{"label":64,"url":65},"Google Workspace: removing a user and preserving data","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fusers\u002Fdelete-or-remove-a-user-from-your-organization",{"label":67,"url":68},"Microsoft 365: former-employee access and data","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fmicrosoft-365\u002Fadmin\u002Fadd-users\u002Fremove-former-employee?view=o365-worldwide",{"title":70,"paragraphs":71},"Review sessions, grants and credentials independently",[72,73],"A password change may not revoke every token, delegated permission, connected app or service credential. Use the provider's applicable controls and verify their scope. Review recovery email addresses and factors as well as the main sign-in path. An account that cannot sign in interactively may still be connected to a workflow through a different mechanism.","For a shared credential the person knew, identify authorized consumers before rotation. Replace it through an agreed change plan and check the business function afterwards. Do not paste the new value into the checklist. An integration should not silently remain owned by a departed individual simply because replacing it takes coordination.",{"title":75,"paragraphs":76,"example":79},"Transfer the business function, not the person's identity",[77,78],"Move ownership or responsibility through supported administrative mechanisms. A generic shared login can make future attribution and removal harder. Where an appropriate service identity or delegated role is supported, define its owner and limits. A replacement employee should receive the access needed for their role, rather than inherit every permission the former account accumulated.","Check websites, forms, backup jobs, billing notices and supplier contacts that may depend on the account. If a replacement cannot be completed safely within the departure window, record a controlled temporary arrangement and a follow-up owner. Avoid keeping unrestricted access enabled without an explicit decision merely to prevent an automation failure.",{"title":80,"text":81},"Illustrative dependency decision","A departing employee owns the API credential used by a website form. The checklist covers both removal of that person's access and replacement of the credential through an authorized owner, followed by a synthetic delivery check. Disabling the mailbox alone does not answer either integration question.",{"title":83,"paragraphs":84},"Verify the result and preserve a useful handover",[85,86],"Use authorized administrative evidence and controlled checks to confirm the intended state. Record which roles or sessions were addressed, which ownership transfers completed and which functions were tested. Do not attempt a former employee's private account login to prove removal, and do not use real customer submissions as test data when a synthetic check will suffice.","Separate completed actions from unverified systems, supplier requests and exceptions. A concise handover should identify the decision-maker, operator, times, evidence references and remaining work. Protect the record: an offboarding map can itself reveal valuable information about the business even when it contains no passwords.",{"title":88,"paragraphs":89},"Review the process for the next departure",[90,91],"Unexpected dependencies reveal improvements for ordinary access management. Assign ownership when a new system is introduced, use appropriate roles and make recovery independent of one individual. The aim is a process that the authorized business can repeat, rather than a last-minute search through the departing person's inbox.","CyberFixCrew is an Israeli cybersecurity company serving worldwide businesses in website and digital-infrastructure work. We can clarify a scoped technical access review or implementation task; we do not make employment decisions or certify legal compliance. Describe the affected systems and timing without including private employee files or secrets in an initial enquiry.","Offboarding completion checks",[94,95,96,97,98,99],"An authorized owner has agreed timing, preservation and access decisions.","The inventory includes infrastructure, shared groups, applications and secrets.","Data ownership is handled separately from sign-in restrictions and deletion.","Provider-specific session and recovery controls have been considered.","Replacement integrations are checked without exposing credentials.","Every incomplete item has an owner and an explicit next action.",[101,104,107],{"question":102,"answer":103},"Can we just delete the employee's mailbox?","That may lose information or leave access elsewhere. Decide preservation, ownership and provider-specific account actions first, then verify relevant sessions, applications and other systems.",{"question":105,"answer":106},"Should we change every password at once?","Use the authorized access map and scope the affected secrets. Rotation can interrupt services, so identify consumers, replace the credential appropriately and verify business operation. A current compromise may need a separate incident response.",{"question":108,"answer":109},"Does the same checklist apply legally in every country?","No, it is a technical coordination framework. Employment, privacy, retention and notification decisions need the relevant authorized business and professional advice for the jurisdiction and circumstances.",[111,112,113,116],{"label":64,"url":65},{"label":67,"url":68},{"label":114,"url":115},"OWASP: authorization controls","https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FAuthorization_Cheat_Sheet.html",{"label":117,"url":118},"NIST SP 1300: small-business cybersecurity","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F1300\u002Ffinal",[120,122,124,127,130,133,136,139],{"path":13,"label":121},"Account access and MFA implementation",{"path":14,"label":123},"Business mailbox and ownership tasks",{"path":125,"label":126},"\u002Fservices\u002Fbackups","Plan protected recovery access",{"path":128,"label":129},"\u002Fservices\u002Fwordpress-security","Review website and hosting access",{"path":131,"label":132},"\u002Fblog\u002Fwordpress-security-checklist","Maintain clear ownership during normal operations",{"path":134,"label":135},"\u002Fhow-it-works","Agree authority, scope and handover",{"path":137,"label":138},"\u002Fblog\u002Fleast-privilege-small-business","Review duties and effective permissions",{"path":140,"label":141},"\u002Fblog\u002Fpassword-manager-business","Review shared credentials and vault ownership",{"title":143,"description":144,"button":145,"type":146},"Map the technical access that needs to change","Tell us the platforms, authorized decision-maker and timing. We will clarify access, dependencies and verification before work.","Discuss an offboarding access review","check",[148,157,164,170],{"id":149,"path":150,"title":151,"description":152,"category":153,"artwork":154,"order":155,"publishedOn":156},"ai-awareness","\u002Fblog\u002Fai-cyber-threats-access-hygiene-employee-awareness","AI Phishing: Verification Habits for Business Teams","AI-assisted phishing uses convincing messages to influence people into disclosing information or taking unsafe actions. Polished writing does not verify the sender. Confirm payment changes, access requests and sensitive disclosures through an existing trusted contact, supported by clear approvals, suitable MFA and a simple route for staff to report concerns.","access","performance",98,"2026-05-07",{"id":158,"path":159,"title":160,"description":161,"category":153,"artwork":153,"order":162,"publishedOn":163},"P063","\u002Fblog\u002Fworkspace-mfa-setup","Google Workspace 2-Step Verification setup without avoidable lockouts","Plan Google Workspace 2SV by users, policy scope, enrollment, recovery and enforcement. Verify actual sign-in behavior before extending the rollout.",88,"2026-10-18",{"id":165,"path":166,"title":167,"description":168,"category":153,"artwork":153,"order":169,"publishedOn":16},"P197","\u002Fblog\u002Fwhy-passwords-fail-entropy-vs-mfa","Strong passwords, passkeys and MFA: what each protects","Compare guessing, phishing and session theft. See when synced passkeys can meet AAL2 and what NIST requires at AAL3.",108,{"id":171,"path":140,"title":172,"description":173,"category":153,"artwork":153,"order":174,"publishedOn":175},"P065","How to choose a business password manager and test the fit","Compare business password managers through ownership, vault access, recovery, staff workflows and exit. Use a synthetic pilot before moving production secrets.",80,"2026-10-10",[],null,{"path":179,"label":180},"\u002Fresources","Website security resources and templates",{"path":182,"label":183},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058705]