In most companies, onboarding and offboarding belong to HR, and the IT department is usually the last to hear about it. Many have seen the result: a new employee sits idle on day one with no computer or user account, while someone who left months ago still has company email on their phone or connects over VPN. The solution is a fixed process and a shared checklist between HR, the department manager and IT.
The Main Rule: IT Must Be Informed on Time
Without timely notice, no checklist works. Define a standard form or request that HR fills out for every hire, transfer and departure: name, title, department, date and required access. A departure request must also state the exact date and time access is to be cut off.
Onboarding a New Employee
- Before day one: The user account is created based on the role, and the computer, desk phone extension and necessary equipment are ready.
- Role-based access: Email, shared folders, accounting or inventory software and other systems, only as much as the role requires.
- Day one: The employee changes the temporary password, enables multi-factor authentication (MFA), and reads and signs the acceptable use policy.
- Short security training: Spotting suspicious emails, how to report problems to IT and where to store files properly.
- Asset register entry: Every device handed over is recorded under the employee’s name with its serial number.
Offboarding: A List Where Nothing Should Be Missed
Cutting off access is not just disabling the domain account. Each employee’s accounts are usually spread across many places:
- Network and domain account: Disable it the same day; do not delete it right away.
- Email: Block sign-in, set up an auto-reply or forward mail to a successor, and retain the mailbox according to company policy.
- Remote access: The VPN account, remote support tools and any other remote access.
- Business applications: Accounting, inventory, CRM and systems that have separate accounts not linked to the domain.
- Online services: Panels and accounts created with the employee’s email or phone number, such as the SMS gateway panel, the company’s social media pages or the domain registrar account.
- Phone: Transfer the extension to a successor or disable it, and check the voicemail.
- Equipment: Collect laptops, phones, storage drives, tokens, access cards and keys.
- Personal phone: If company email or data was on a personal phone, remove that access too.
Do not forget shared passwords. If the employee knew the Wi-Fi password, shared account credentials or a device password, change those passwords after they leave.
Before Wiping the Laptop
Work data on a departing employee’s computer belongs to the company. Before reinstalling Windows, agree with the department manager which files should be moved to a successor or the file server, and take a backup of the disk to keep for a while.
Sensitive Cases
- Unexpected or contentious departures: Cut off access at the same time the person is informed, not afterward.
- Departure of a network admin or IT staff member: Change all admin passwords, from the firewall and network equipment to server accounts, hosting and data center panels, and access keys. A complete list of these accounts should already be recorded in a secure place.
- Contractors and project staff: Their accounts should have an expiration date from the start.
Checklist
- An onboarding and offboarding form between HR and IT is defined.
- A new employee’s account and equipment are ready before day one.
- A list of all accounts and systems for each role exists.
- On the last day, all access is cut off, from the domain to online services.
- Equipment is collected and work files are transferred.
- Shared passwords the employee knew are changed.
Well-organized onboarding and offboarding improves security and makes daily work run more smoothly. ITPlus724 engineers can design and implement this process and its checklists to fit your company’s systems.