Staff changes
What should happen to IT access when an employee leaves?
Closing an email account is one step in a staff departure. Review other accounts, preserve business records and confirm the handover.
An employee returns their laptop and leaves the building. Their email sign-in is blocked. Has their IT access been dealt with?
Check the other systems they used before closing the request. A separate scheduling tool, a supplier portal or access to a client's shared folder may sit outside the main company account.
Management, HR and IT need to coordinate the departure before access changes are due. The Cyber Centre's baseline controls recommend a process to revoke accounts when they are no longer required, including when employees leave.
Agree on the timing and authority
Management or HR should provide the authorized departure time, the person approving the changes and a contact for questions. IT should confirm it has received the request and can carry it out at the required time.
For a sensitive departure, coordinate the steps closely and share details only with the people who need them. Access changes should follow the approved departure plan rather than an assumption about the employee's last calendar day.
Work from an account and access list
Check the systems the person actually used. Include:
- Company sign-in, email, file storage and collaboration tools.
- Business applications, remote access and separate administrator accounts.
- Client portals, supplier systems and external guest access.
- Password-manager access, shared credentials and recovery methods.
- Company devices, security keys and other access equipment.
Disabling the main account may not immediately end every existing session or remove access in a separately managed service. Have IT check the relevant session, token and application controls for the systems involved.
Preserve the records the organization needs
Decide who will take responsibility for active work, shared files, calendars and business records. Use approved delegation or transfer features instead of handing the departing employee's password to someone else.
Mailbox access and forwarding need an explicit business purpose, appropriate authorization and a review date. Broad access to an entire mailbox may expose personal or unrelated confidential information.
Before deleting accounts or removing licences, check retention requirements, legal holds and any effect on stored information with the appropriate advisers and IT team. Immediate deletion can complicate a handover or destroy records the organization needs.
Check shared access and equipment
If the person knew a shared password or held a reusable credential, assess whether it needs to be changed and update the people or services legitimately using it. Record any dependencies so a credential change does not unexpectedly stop an important process.
Confirm equipment return and the handling of company information on personal devices through the agreed policy. Do not treat a remote wipe of an entire personal device as a routine substitute for that process.
Close the request with evidence
Record what was changed, when it was completed and which items remain open. Someone should own follow-up for an external account, missing device or delayed transfer.
Review the checklist after the departure. If you discovered an unknown application, add it to the access inventory. Keep the inventory and checklist current for the next departure.
Make staff departures easier to manage
We review account ownership, departure procedures and handover arrangements. The aim is to close access at the right time while keeping the records and systems the business needs.