Offboarding

Offboarding is everything a business does when someone leaves, and half of it is human, meaning the handover, the last pay slip and the goodbye. The other half is security, and that is the half that gets forgotten. It is really a list of doors, so somebody has to close all of them on the same day.

Start with what should be switched off within the hour. Email comes first, because the password resets for every other system arrive there. After the mailbox comes the main business system, then the till, then any remote access, and last anything that touches customer records or money. If the parting was difficult, do not wait for the final afternoon, since most of the damage happens in those last hours rather than weeks later.

Then come the things nobody writes down. The phone in their pocket still has the work app installed, and it may still be signed in. There is also the laptop at home, the tablet in the delivery van, and the customer list they emailed to themselves last spring to read on the train. Worst of all is the password everyone in the office knows, because that one cannot be switched off. It has to be changed, and everybody who stays has to be told the new one.

The fix is to write that list once and reuse it every time. Name each account, who owns it, and who switches it off when a person goes. It costs twenty minutes today and five minutes at every leaving after that, which is why it is worth doing before you need it. When Linkysoft builds a web application for a business, one button ends a person's access everywhere and keeps their old records, so the invoices they raised still show their name.

One rule matters more than the rest, and it is to disable an account rather than delete it. A deleted account can take last year's orders with it, and you may one day need to prove who approved a payment, so Linkysoft keeps the history and simply closes the door. We also ask about the leaver's own phone, because a personal device is not company property and cannot just be wiped. Agreeing that in writing when you hire, rather than when someone leaves, is the step most businesses skip, and our cybersecurity team raises it early.