1. Home
  2. Resources
  3. Employee Offboarding Checklist: Revoke Access Before It Breaches
IT Infrastructure

Employee Offboarding Checklist: Revoke Access Before It Breaches

Roman Burdiuzha
Roman Burdiuzha
Cloud Architecture Expert Co-founder & CTO of Gart
Employee Offboarding checklist

When someone leaves a company, HR runs one checklist — final paycheck, exit interview, return of the badge. IT and security need a different one: an employee offboarding checklist built around a single question — what can this person still do, and how fast can that power be taken away? The two checklists rarely run on the same clock, and the gap between them is where a routine departure quietly turns into a security incident.

Most organizations discover the gap the hard way. An account survives past its owner’s last day. A shared password never gets rotated. A personal laptop keeps syncing to a company drive nobody remembered to disconnect. None of it looks dramatic in the moment — it just sits there, unattended, until someone notices it shouldn’t still work. A security audit is usually where that discovery happens first, because reviewing who has access is one of the fastest ways to see how many “former” employees still show up as “active.” This guide breaks the employee offboarding checklist into what to revoke, in what order, who’s accountable for each step, and the parts most checklists miss entirely.

Table of contents
  1. What an Employee Offboarding Checklist Needs to Cover
  2. Why Offboarding Gaps Turn Into Breaches
  3. The Employee Offboarding Checklist, Step by Step
  4. Offboarding by the Clock: A Phased Timeline
  5. Who Owns Each Offboarding Step
  6. High-Risk Offboarding: When to Escalate
  7. Automating What a Manual Checklist Keeps Missing
  8. Common Offboarding Mistakes

What an Employee Offboarding Checklist Needs to Cover

An employee offboarding checklist is the sequence of actions that removes a departing employee’s ability to access systems, data, and physical space — coordinated across HR, IT, security, and the person’s manager, on a fixed timeline rather than “whenever someone gets to it.” A good one covers five categories of exposure: identity and authentication (accounts, SSO, MFA devices), data and devices (laptops, phones, cloud storage, local files), financial and procurement access (expense tools, vendor portals, purchasing cards), knowledge and communications (shared inboxes, chat channels, documentation permissions), and physical access (badges, keys, parking, server rooms).

What makes offboarding harder than onboarding is that nobody owns the whole list by default. Onboarding has a natural champion — someone wants the new hire productive on day one, so provisioning gets attention. Offboarding has no equivalent pressure once the person is gone; the checklist only matters to people who aren’t in the room advocating for it, which is exactly why it drifts. Most teams that treat offboarding informally discover the gap during a broader infrastructure audit, where a routine access pull turns up accounts belonging to people who left months earlier.

Why Offboarding Gaps Turn Into Breaches

The risk isn’t hypothetical, and it isn’t rare. Independent research on former-employee access keeps landing on the same conclusion from different angles: offboarding is one of the most under-engineered processes in enterprise IT, and the gap between “employee left” and “access fully removed” is measured in days or weeks far more often than in minutes.

What the research shows: A Beyond Identity study of former employees across the US, UK, and Ireland found 83% still had access to at least one account from a past employer, and more than half of those admitted to using that access with intent to harm their former employer. The same study found the offboarding process itself was incomplete in most cases — only 50% of departing employees were asked to return company devices, only 41% returned security keys or tokens, and only 35% had their accounts actually deleted or reset. In one of the most-cited studies on this exact gap, OneLogin found half of ex-employee accounts remain active for more than a day after departure, 32% of organizations take over a week to fully deprovision someone across every application, and one in five respondents said failure to deprovision a former employee had directly contributed to a data breach at their company. The Ponemon Institute’s 2025 Cost of Insider Risks report puts the annual average cost of insider risk at $17.4 million, up from $16.2 million two years earlier, and names poor offboarding as one of the highest-leverage, fastest-to-fix contributors.

None of this requires malicious intent to become a problem. A departed contractor’s still-valid API key, an old admin login sitting in a password manager nobody rotated, a Slack channel a former employee can technically still read — each one is a small, boring gap that widens the window for something to go wrong, whether that’s a curious ex-employee, a phished credential reused from an old account, or simple negligence. A handful of signals reliably mean an organization’s offboarding process has a gap worth investigating:

  • Nobody can produce, on request, a current list of every system a specific departed employee had access to.
  • Offboarding is triggered by a manager remembering to email IT, rather than by an HR system event.
  • Shared or admin-level passwords aren’t rotated when someone with knowledge of them leaves.
  • SaaS licenses for departed employees sit unused for months before anyone notices the recurring charge.
  • There’s no record of who confirmed that a given offboarding was actually completed.

The Employee Offboarding Checklist, Step by Step

The sequence below covers the five exposure categories from the section above, ordered so the highest-risk items move first. It’s written as a single master checklist — in practice, the first block should be complete within hours of departure, not days:

  1. Disable the identity provider account first. Suspending or disabling the account at the SSO/identity provider level (Okta, Entra ID, Google Workspace) cuts access to every connected app in one action, faster than deprovisioning each system individually.
  2. Revoke active sessions and refresh tokens. Disabling the account doesn’t always kill an already-open session — force a session revoke so existing logins stop working immediately, not just new ones.
  3. Remove or rotate MFA devices and recovery methods. Delete registered authenticator apps and hardware keys, and clear personal phone numbers or recovery emails tied to the account.
  4. Rotate any shared or admin credentials the person knew. Root passwords, shared service accounts, and infrastructure secrets they had visibility into should be rotated, not just their personal login.
  5. Deprovision individual SaaS and cloud application accounts. Pull the full list of licensed tools, not just the obvious ones — this is where unused SaaS licenses most often originate, sitting active and billed long after the person who used them is gone.
  6. Reassign or archive owned data. Transfer ownership of shared drives, documents, CRM records, and repositories the person owned so nothing becomes orphaned or inaccessible to the team.
  7. Collect and wipe company devices. Retrieve laptops, phones, and hardware tokens; trigger a remote wipe immediately if a device can’t be physically recovered on the last day.
  8. Close out financial and procurement access. Cancel corporate cards, remove approval authority in expense and purchasing systems, and revoke vendor-portal logins.
  9. Update shared inboxes, distribution lists, and chat channels. Remove the person from group email aliases and private channels; set up mail forwarding or an auto-responder only if there’s a documented business need.
  10. Revoke physical access. Deactivate badges, collect keys, and remove the person from any building or server-room access lists.
  11. Log the offboarding as complete, with a named approver. Record who confirmed every step above was done and when — this record is what turns “we think we offboarded them” into something an auditor can actually verify.

Offboarding by the Clock: A Phased Timeline

The checklist above tells you what to do; the timeline below is about when. Not every item needs to happen in the first minute, but the highest-risk ones — identity, sessions, credentials — shouldn’t wait for a convenient batch-processing window:

PhaseWhat HappensPriority
T+0 (departure confirmed)HR triggers an offboarding event to IT/security — ideally automatically from the HRIS, not by emailTrigger
Within 1 hourIdentity provider account disabled, active sessions and tokens revoked, MFA devices removedCritical
Within 24 hoursFull application deprovisioning, credential rotation, device collection or remote wipe initiatedHigh
Within 7 daysData and license reassignment, financial/procurement access closed, physical access lists updatedStandard
Within 30 daysAccess audit confirms zero remaining live accounts tied to the departed employee; offboarding logged as closedVerification
Offboarding by the Clock: A Phased Timeline
The employee offboarding checklist works against a clock, not just a task list — the highest-risk steps (identity and sessions) need to close within the first hour, not the first week.

Who Owns Each Offboarding Step

Ambiguous ownership is the single most common reason offboarding checklists don’t get finished — every step has an obvious “should” owner, and no one confirms it actually happened. A short RACI-style split closes most of that gap without adding new headcount:

StepPrimary OwnerConfirms Completion
Trigger the offboarding eventHR / People OpsHR system record
Identity, sessions, MFA, credential rotationIT / SecurityIT ticket or automation log
SaaS & app deprovisioning, license reclaimIT / App ownersOffboarding checklist sign-off
Data & document reassignmentDirect managerManager confirmation
Device collection / remote wipeITAsset management record
Physical access revocationFacilities / SecurityBadge system log
Final audit & sign-offIT / Security leadNamed approver on record
Who Owns Each Offboarding Step

This is the same ownership question that surfaces in a user access review — access-related work stalls whenever “IT” is listed as the owner of everything, because that usually means no single person is actually accountable. Naming a role, not a department, against each row is what makes the checklist enforceable rather than aspirational.

High-Risk Offboarding: When to Escalate

The standard checklist and timeline above cover a routine, amicable departure. Several situations call for a faster, tighter version of the same process rather than a different one. Involuntary terminations and layoffs carry meaningfully higher risk of retaliatory access misuse, so access should be cut before — or at the very latest, at the exact moment of — the termination conversation, not sometime afterward. Anyone holding privileged or admin-level access (infrastructure, production databases, financial systems, code repositories with deploy rights) needs every credential they touched rotated, not just their personal account disabled, since privileged accounts are the ones an attacker or a disgruntled insider can do the most with. Departures to a direct competitor warrant a closer look at recent data exports, downloads, and file-sharing activity in the days leading up to the exit. And contractors and third-party vendors are frequently the weakest link in offboarding precisely because they sit outside the standard HR-triggered workflow — their access needs an explicit end date built in from day one, not a manual removal that depends on someone remembering the engagement ended.

None of these cases need a separate process from scratch — they need the same least-privilege access model principle applied more aggressively: assume the highest-risk departures get the fastest, most complete revocation, and build the standard checklist to escalate automatically when one of these flags is present rather than relying on someone remembering to ask for the faster version.

Automating What a Manual Checklist Keeps Missing

A checklist, however well-written, depends on someone remembering to run it correctly every single time — and offboarding happens irregularly enough that “every single time” is exactly where manual processes break down. The fix most lean IT teams reach for first is triggering offboarding automatically from the HRIS: the moment HR marks an employee as terminated, that event fires a workflow that disables the identity-provider account, revokes sessions, and kicks off deprovisioning across connected apps — no email, no ticket, no dependence on someone’s memory. NIST’s guidance on personnel security controls (SP 800-53, personnel termination control PS-4) formalizes exactly this expectation: system access should be disabled no later than the time of termination, with organizational property retrieved and access-granting credentials invalidated as part of the same event, not a follow-up task.

SCIM-based provisioning and identity governance platforms extend that same event to every SCIM-connected SaaS app automatically, closing the gap where individual app deprovisioning is the slowest, most frequently skipped step on the manual checklist. Teams already running periodic quarterly access reviews get an added benefit from automating offboarding specifically: reviews stop having to catch offboarding failures after the fact, because there are far fewer of them left to catch. Deciding how far to take this — a lightweight HRIS-to-identity-provider trigger versus a full identity governance platform — is its own build-vs-buy question; teams weighing the options can start with a broader look at access review and offboarding automation options before committing to a specific tool.

Common Offboarding Mistakes

A handful of mistakes account for most of the offboarding gaps that eventually surface in an audit or, worse, a breach investigation:

  • Treating offboarding as an IT-only task. Without HR triggering the event and managers confirming data handoff, IT is often the last to know a departure happened at all.
  • Disabling the account but skipping session and token revocation. A disabled account with a still-active session or API token isn’t actually offboarded — it just looks that way in the admin console.
  • Forgetting shared and service accounts. Individual logins get deprovisioned; shared admin passwords and service-account credentials the person knew rarely get rotated on the same schedule, if at all.
  • No verification step. Running the checklist isn’t the same as confirming it worked — without a named approver checking every item, “we offboarded them” is an assumption, not a fact.
  • Letting licenses sit instead of reclaiming them immediately. Deprovisioning access and canceling the license are two different actions; skipping the second is how orphaned SaaS spend accumulates quietly for months.

Not confident your offboarding checklist actually closes every account?

Gart Solutions audits identity, access, and infrastructure end to end — surfacing every orphaned account, unused license, and lingering credential left behind by past offboarding, then helping you build the automated process that keeps it from happening again.

10+ Years in DevOps & Cloud
50+ Enterprise clients secured
4.9★ Clutch rating
Security Audit Compliance Audit (SOC 2 / NIS2) IT Infrastructure Audit Cybersecurity Monitoring DevSecOps
Talk to an Infrastructure Expert →

Roman Burdiuzha

Roman Burdiuzha

Co-founder & CTO, Gart Solutions · Cloud Architecture Expert

Roman has 15+ years of experience in DevOps and cloud architecture, with prior leadership roles at SoftServe and lifecell Ukraine. He co-founded Gart Solutions, where he leads cloud transformation and infrastructure modernization engagements across Europe and North America. In one recent client engagement, Gart reduced infrastructure waste by 38% through consolidating idle resources and introducing usage-aware automation. Read more on Startup Weekly.

Roman Burdiuzha
Roman Burdiuzha
Cloud Architecture Expert Co-founder & CTO of Gart

FAQ

What is an employee offboarding checklist?

An employee offboarding checklist is a documented, sequenced list of actions — spanning identity and access, data and devices, financial systems, communications, and physical access — that removes a departing employee's ability to reach company systems and data. It's coordinated across HR, IT, security, and the employee's manager, and works against a fixed timeline rather than being completed whenever someone has time.

Why is an employee offboarding checklist important for security?

Incomplete offboarding leaves active accounts, valid credentials, and standing data access tied to people no longer employed. Research from Beyond Identity found 83% of former employees retain access to at least one account from a past employer, and over half of those admit to using that access with intent to harm their former employer — a risk that a documented, timed checklist directly closes.

Who is responsible for employee offboarding?

Responsibility is shared: HR typically triggers the offboarding event, IT and security handle identity, credential, and application deprovisioning, the employee's direct manager reassigns owned data and confirms handoff, and facilities or security manages physical access. Assigning a named owner and approver to each step — not just a department — is what prevents steps from being silently skipped.

When should employee access be revoked?

Identity-provider access, active sessions, and MFA devices should be revoked within the first hour of departure being confirmed, with full application deprovisioning and credential rotation completed within 24 hours. For involuntary terminations, access should be cut before or at the moment of the termination conversation rather than afterward, given the higher risk of retaliatory misuse.

How long should offboarding take from start to finish?

Critical access (identity, sessions, MFA) should close within an hour; full deprovisioning across applications and devices within 24 hours; data, financial, and physical access items within a week; and a verification audit confirming zero remaining access within 30 days. Research shows many organizations fall well short of this — one widely cited study found 32% of organizations take over a week just to fully deprovision a single departing employee.

What happens if a company doesn't properly offboard an employee?

Incomplete offboarding leaves orphaned accounts and standing access that can be misused, whether through negligence, credential compromise, or intentional retaliation. It also creates ongoing costs even without an incident — unused SaaS licenses stay billed, and the gap routinely surfaces as a finding in SOC 2, ISO 27001, or NIS2 compliance audits, where auditors specifically test whether terminated employees' access was actually removed.

How do you offboard a remote employee securely?

Remote offboarding follows the same checklist with two additions handled earlier: schedule courier pickup or a prepaid return kit for company devices before the final day rather than after, and initiate a remote wipe immediately if a device isn't returned promptly, since there's no in-person handoff to fall back on. Identity and session revocation should happen on the same one-hour clock regardless of whether the departure is remote or in-office.
arrow arrow

Thank you
for contacting us!

Please, check your email

arrow arrow

Thank you

You've been subscribed

We use cookies to enhance your browsing experience. By clicking "Accept," you consent to the use of cookies. To learn more, read our Privacy Policy