Employee Offboarding Security: Stop Ex-Staff Becoming a Risk

Employee offboarding security is the set of steps that stops a former staff member’s access, devices and data from becoming your next incident. Most people leave on good terms, and most problems aren’t deliberate. However, an account nobody disabled, a shared password nobody changed or a laptop that never came back can expose your business long after the farewell drinks.

This guide explains why ex-employees create risk and sets out nine practical steps, from the day someone resigns to the regular reviews that catch what slips through.

Why employee offboarding security matters

Access grows quietly. Over a few years, a staff member collects logins for email, file shares, the CRM, finance tools, supplier portals and a handful of apps someone signed up for on a credit card. When they leave, each of those is a door that has to be closed. Miss one, and someone who knows your systems well still has a key.

Most incidents are accidental: synced files on a personal phone, an inbox still receiving client email, or a contractor login nobody remembered. A smaller number are deliberate, such as copying a customer list before resigning or deleting records after a dismissal. Either way, the cost is real. ASD’s latest threat report puts the average self-reported cost of a cybercrime at $56,600 for a small business and $97,200 for a medium one.

Employee offboarding security in nine steps

Select a step to jump to the detail.

Before they leave

1. Start offboarding the day a departure is confirmed

The biggest gap is usually timing. HR knows someone has resigned, but IT hears about it a week after they’ve gone. Instead, make the resignation, termination or contract end the trigger for a written checklist with a named owner and a completion sign-off.

For example, a simple form that HR submits on the day of notice can create an IT ticket automatically. In addition, agree in advance how to handle a high-risk departure, such as a dismissal or someone joining a competitor, where access may need to end the same hour.

2. Know every account the person holds

You can’t remove access you don’t know about. Keep a current list, for each person, of their accounts, licences, devices, shared mailboxes, admin roles and software subscriptions. Single sign-on through Microsoft 365 or another identity provider makes this far easier, because one switch closes many doors.

As a result, the list becomes your offboarding checklist. Also look for “shadow IT”: free tools staff signed up for with a work email, which often hold business files nobody else can see.

3. Reduce access during the notice period

Good employee offboarding security starts before the last day. Most departing staff work their notice professionally, and they still need to do their job. Even so, remove admin rights and access to sensitive systems they no longer need, and hand over critical passwords and duties early.

If you plan to watch activity such as large downloads, check the law first. NSW and the ACT have workplace surveillance laws that generally require at least 14 days’ written notice before computer surveillance starts, and other states regulate surveillance devices. A clear IT use policy, given to staff when they start, is the simplest way to stay on the right side of these rules.

Employee offboarding security on the last day

4. Disable accounts and revoke every session

Disabling a password isn’t enough on its own. Phones, browsers and apps can stay signed in for days using saved tokens. So block sign-in, revoke active sessions, remove registered multi-factor authentication methods and check for mail forwarding rules or app passwords. Then close VPN, remote desktop and building access.

Above all, disable rather than delete at first. Deleting an account can destroy the mailbox and files you may need later, while a disabled account keeps the data and stops the access.

5. Change shared passwords and secrets

Every shared login the person knew must change: social media, website and hosting admin, domain registrar, Wi-Fi, alarm codes, supplier portals and any API keys they handled. A password manager with shared vaults shows exactly which secrets someone could see, which turns this from guesswork into a list.

Better still, reduce shared logins over time. Individual accounts with multi-factor authentication are easier to switch off and leave a clear record of who did what.

6. Recover devices and remove business data

Devices are a common gap in employee offboarding security. Collect laptops, phones, security keys, access cards and keys, and record what each person returned. For personal phones used for work, mobile device management can remove the business apps and data without touching personal photos or messages.

Meanwhile, check that business data hasn’t ended up in personal cloud storage or email. Your IT use policy and employment agreement should say that business information must be returned or deleted when someone leaves.

After they’ve gone

7. Transfer ownership and keep the records

Give a manager access to the former employee’s mailbox and files, or convert the mailbox to a shared one, so client conversations aren’t lost. Transfer ownership of shared folders, automations and documents, and keep a record of every offboarding action and when it happened.

Personal information needs care too. Under the Privacy Act, businesses it covers must take reasonable steps, including technical and organisational measures, to protect personal information, and must destroy or de-identify it once it’s no longer needed. In practice, that means a retention plan for the former employee’s data rather than keeping everything forever.

8. Check contractors, suppliers and partners

Employee offboarding security also covers access that sits outside your own systems. A departing staff member may have set up supplier portals, integrations or logins with outside providers. Ask them to list these during the notice period, then close or transfer each one.

Similarly, give contractors and temporary staff separate accounts with expiry dates from the start. When the engagement ends, access ends automatically rather than relying on someone to remember.

9. Review access on a regular schedule

Even good processes miss things, so review accounts on a schedule. The Essential Eight sets a useful benchmark for admin accounts: at Maturity Level Two, businesses disable privileged access after 45 days of inactivity, and after 12 months unless someone revalidates it. Applying the same idea to every account catches leftovers quickly.

In addition, give people only the access their role needs, using role-based groups rather than one-off permissions. Smaller access footprints are quicker to remove and do less harm if one is missed.

If something goes wrong

Even with strong employee offboarding security, incidents can still happen. If you suspect a former employee has used old access or taken data, act quickly but carefully. First, cut off the access and change related passwords. Then preserve logs and devices before anything is wiped or reset, because that evidence matters for any legal or insurance claim. Our computer forensics team can help preserve evidence, analyse what happened and report on it.

If personal information may have been exposed, the Notifiable Data Breaches scheme requires an assessment within 30 days at most, and notification to the OAIC and affected people if serious harm is likely. You can also report cybercrime through ReportCyber or call ASD’s Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), 24 hours a day.

How CAG helps with employee offboarding security

We document each client site’s systems and processes, so when someone leaves we know which accounts, devices and shared logins to close. Our team handles Microsoft 365 setup and management, disables access and revokes sessions, recovers and resets devices, and keeps a record of each step.

Behind that, our cyber security services include 24/7 monitoring, EDR with automatic containment and security awareness training. Cyber security audits and Essential Eight assessments find dormant accounts and excess admin rights, and we help map your existing controls to ASD Essentials. For the wider picture, see our guide to keeping business data secure.