Employee Offboarding and Access Reviews: An IT Security Checklist for Mid-Market Owners and Operators

Employee Offboarding and Access Reviews: An IT Security Checklist for Mid-Market Owners and Operators

2026-10-17

The takeaway: Turning off someone’s email isn’t offboarding. When a person leaves, disable every account that day, end their live sessions, collect devices and badges, hand their files to a named owner, and change any shared password they knew. Then review who has access to what every quarter. The Cybersecurity and Infrastructure Security Agency’s (CISA) Cross-Sector Cybersecurity Performance Goals 2.0, released December 11, 2025 and aimed at businesses “of all sizes,” call for the core of this: a defined, enforced offboarding process that revokes all access, plus quarterly access reviews (CISA CPG 2.0; release, Dec 11, 2025).

What it costs when access outlives the job

Two federal cases show both sides of the risk.

  • Access that stayed open. A man who had worked for Cisco resigned around April 2018. On September 24, 2018, he got into Cisco’s cloud infrastructure on Amazon Web Services without permission and deployed code that deleted 456 virtual machines for WebEx Teams. More than 16,000 accounts were shut down for up to two weeks. Cisco spent about $1.4 million in employee time on repairs and refunded more than $1 million to customers, according to the U.S. Attorney’s Office, which announced his two-year sentence (DOJ, Dec 9, 2020).
  • Sabotage planted before the exit. After a 2018 realignment cut his responsibilities and system access, a software developer at an Ohio-based company planted code, including a “kill switch” that would lock out all users if his Active Directory account was disabled. It fired when he was placed on leave on September 9, 2019, hitting thousands of users (DOJ, Aug 21, 2025). He was sentenced to four years.

The first case calls for same-day revocation everywhere, not just in the main directory. The second shows why technical staff who leave, or lose a role, need a review of what they built, not just a flipped switch.

Step 1: Map access before anyone resigns

You can’t revoke what you don’t know about. For each role, list single sign-on (one login that opens many apps) and email; apps people log into with their own password; admin consoles for cloud, firewall, website, domain, payroll, and bank; shared passwords; VPN and remote tools; phones and MFA tokens; and badges and keys. Apps someone signed up for with a company card are the usual blind spot.

Step 2: Make HR’s notice the trigger

NIST’s control catalog, SP 800-53 Rev. 5, suggests automated ways to notify the right people and disable access at termination, because in larger organizations not everyone who needs to know hears in time (control PS-4(2)) (NIST SP 800-53 Rev. 5). The low-tech version: one offboarding ticket, opened by HR, with IT, finance, and the manager each signing off. Microsoft’s guidance for its Entra ID directory recommends automated deprovisioning (removing a user’s accounts in connected apps) plus a defined process for apps that can’t be automated (Microsoft Learn).

Step 3: Run the day-of checklist

NIST’s PS-4 says that on termination you disable system access within a set time, revoke credentials, hold an exit interview, retrieve property, and keep access to information the person controlled. As a list:

  1. Disable accounts in your directory and every app on the access map.
  2. End live sessions. Disabling a login doesn’t end every session. Microsoft notes that access tokens from Entra ID last one hour by default, and that Entra can’t directly revoke session tokens issued by other apps. Use “Revoke sessions,” then sign the person out of apps that manage their own sessions.
  3. Change shared passwords and recovery codes they knew, and remove their phone from MFA on shared accounts.
  4. Collect laptops, phones, badges, and keys, then wipe or reissue them.
  5. Hand off data. Move the mailbox, files, and recurring jobs to a named owner before deleting anything.
  6. Cover the paperwork. NIST pairs exit interviews with reminders about nondisclosure agreements. Let your employment counsel decide what you say.

NIST adds that timing is essential when someone is terminated for cause, and that organizations sometimes disable accounts before the person is told.

Step 4: Include contractors, vendors, and role changes

CISA’s offboarding goal (3.D) covers contractors and vendors, not just employees. NIST’s PS-5 adds transfers: when someone changes roles, confirm what they still need and remove the rest. Without that, a ten-year employee can end up with keys to every department they ever worked in.

Step 5: Review access every quarter

CISA’s least-privilege goal (3.H) recommends quarterly reviews of access permissions and role assignments. Goal 3.D adds disabling accounts inactive for a set period, such as 30 days, ideally automatically. Keep it simple: export users and admins from your ten most important systems, have each manager confirm their people, and remove anything nobody claims.

Step 6: Give admins a closer look

CISA’s goal 3.G says administrators should use separate accounts for admin work, and privileges should be re-evaluated regularly. When someone with admin rights leaves or loses a role, check scheduled tasks, scripts, and service accounts tied to their name.

Two numbers to track

Hours from HR notice to every account disabled, and orphaned accounts found per quarterly review. Both should shrink.

Where outside help fits

Offboarding falls between HR, IT, and finance, so steps get skipped. A fractional CTO or CISO can build the access map, set up the checklist, and run the first quarterly review. Yellow Coop does this under the Secure pillar on what we do, in fractional engagements of 1 to 4 days a week (how we engage). If you’re not sure who still has keys, book a 20-minute call.

Internal links: What We Do, CIO vs CTO vs CISO, How We Engage, Track Record, Contact, Insights.

Sources