Trigger one accountable departure process
Offboarding starts with reliable notice, clear timing and an accountable coordinator. Define which departures require immediate restriction and which follow a planned transition. Human resources, management, identity, technology and physical security need the same effective time and exception route.
Inventory access through central identity, local applications, shared mailboxes, privileged roles, remote tools, supplier portals and physical credentials. Include devices, certificates, security keys and password vaults. A directory disablement may not revoke active sessions, application tokens or cloud-native accounts.
Protect information and continuity
Transfer ownership of documents, mail, automation, repositories and operational responsibilities according to authorised business need. Do not give managers unrestricted access to personal communications by default; apply policy and legal guidance. Preserve records required for investigation or retention.
Rotate shared secrets the person knew and review recent privileged or unusual activity when risk warrants it. Recover managed devices and verify that remote wipe, encryption and inventory state are understood. Personal devices need a defined method for removing organisational data without overreaching into private information.
Verify removal and learn from gaps
After the effective time, test that sign-in, remote access, privileged roles, tokens and delegated permissions are removed. Confirm that temporary transition access has an owner and expiry. Record systems that required manual discovery so future inventories improve.
Measure completion against the agreed time, orphaned ownership, outstanding devices and access found after closure. Sample departures periodically and include contractors and suppliers. The objective is controlled removal without losing evidence or disrupting critical work.
What to do next.
- ✓Define departure authority and effective time.
- ✓Inventory central, local, SaaS and physical access.
- ✓Revoke sessions, tokens and delegated permissions.
- ✓Transfer authorised information and service ownership.
- ✓Rotate known shared secrets.
- ✓Verify access removal after completion.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.