Who Still Has Your Keys? 8 Steps to Offboard an Employee Safely

When an employee walks out the door for the last time, most business owners think about the exit interview, the final paycheck and maybe a farewell lunch. Far fewer think about the dozen or so digital doors that person can still open: email, cloud files, accounting software, the company phone, the shared password spreadsheet nobody wants to admit exists.

For Dallas-Fort Worth small businesses, this is one of the quietest and most fixable security gaps. A former employee does not have to be angry to be a risk. A forgotten login, a personal phone still syncing company email, or an old account that never got turned off can all become the way a stranger gets in. Year-end is also a busy season for staff changes, which makes this the right week to tighten up.

Why offboarding is a security problem, not just an HR task

Think of every employee account as a set of keys. You would not let a departed employee keep the keys to the front door, yet accounts often stay active for weeks or months because nobody owns the job of turning them off. HR knows the person left. IT may not. The manager assumes someone else handled it.

The fix is to treat offboarding as a repeatable checklist with a clear owner, the same way you treat opening and closing the office. Here is the version we recommend to our clients.

The 8-step offboarding checklist

1. Decide the timing before the conversation happens

Access should end at a planned moment, usually when the employee is told or leaves the building. For a friendly resignation with two weeks’ notice, you may phase access down. For a termination, it should happen at the same time as the meeting. Either way, someone must be ready to act on that schedule.

2. Disable the main sign-in first

Blocking the employee’s primary login (for most offices, their Microsoft 365 or Google account) cuts off email, files, Teams or chat, and anything tied to single sign-on. Disable and reset rather than delete. You will need that mailbox and its files later.

3. Sign them out everywhere and reset their sessions

Disabling a password does not always end sessions that are already open on a laptop, phone or tablet. Revoke active sessions and remove saved app tokens so nothing keeps running in the background.

4. Remove multi-factor authentication devices and passkeys

If the employee’s phone is still registered for sign-in approvals, clean that up. Our earlier post on passkeys for small business logins explains why those credentials need to be tracked just like passwords.

5. Recover company devices and wipe company data from personal ones

Collect laptops, phones, badges, keys and any external drives. If staff use personal phones for work email, remove only the company data from those devices rather than wiping everything. Managed device tools make this possible without touching personal photos or messages.

6. Change shared passwords and revisit outside accounts

Anything the employee could log into with a shared credential needs a new one: the company social media pages, the bank portal, vendor sites, the Wi-Fi, the alarm system. This is also the moment to ask whether those shared logins should exist at all. A password manager with individual access makes the next departure far simpler.

7. Hand off the data, then decide what to keep

Forward the mailbox to the manager or convert it to a shared mailbox for a set period, move important files to a team owner, and set a retention plan. Some industries, including healthcare and financial services, have record-keeping obligations, so do not delete anything until you know what applies to you.

8. Document it and check it

Keep a short record of what was turned off, by whom and when. A week later, run a quick check for lingering access, such as old accounts, forwarding rules or connected apps. This record is what an insurer, auditor or attorney will ask for if something goes wrong.

The mistakes we see most often

• No single owner. HR, the office manager and the outside IT provider each assume another one is handling it.
• Deleting too soon. Removing an account erases mailbox history and files you may legally or practically need.
• Forgetting the side doors. Personal phones, shared logins, forwarding rules and third-party apps are the ones that get missed.
• Handling it only when someone is fired. Friendly departures create the same exposure. Every exit gets the same checklist.

Don’t forget the other direction: onboarding

The same discipline that closes accounts on the way out makes the way in smoother. If you want new hires productive on day one, read how we deliver computers that work before they reach your desk. Consistent onboarding and offboarding are two halves of one process.

How to make this automatic

A checklist works until the busy week when nobody has time to follow it. That is why many of our clients put offboarding into their managed IT service: HR sends one request, and the accounts, devices and access are handled the same way every time, with a record to show for it. As a veteran-owned company serving businesses across Dallas-Fort Worth, we have seen how much stress a clear process removes, especially for owners who are also running everything else.

If you are not sure who still has access to your systems today, that is a good place to start. We can review current accounts, spot the ones that should have been closed, and set up a simple process for the next time someone leaves.

Talk to a local team about your offboarding process

Ready to find out who still has the keys? Contact Southwest Technical Support or call 972.528.9600 for a free consultation. We will help you close the gaps before they become a problem.