Free IT Employee Offboarding Checklist
A four-phase offboarding checklist (pre-departure, last day, 24 hours, 7-day follow-up) with 22 tasks covering every system category your auditor will ask about. Includes the critical steps most checklists miss — token revocation, MFA device removal, email forwarding audit, and post-departure audit log verification.
Opens in Excel or Google Sheets. Complete one row per departing employee.
No sign-up required.
4 phases — why timing matters as much as the task itself
The order of offboarding tasks is critical. File ownership must transfer before the account is disabled. Shared secrets must be inventoried before they're rotated. This checklist is structured around the dependencies between steps, not just a flat list.
Google Workspace file ownership transfer
Transferring My Drive and shared drive ownership before disabling the account prevents data loss. You cannot transfer files from a disabled account — it must be done while the account is still active.
GitHub sole-owner identification
If the departing employee is the only owner of a repository, removing them from the org leaves it ownerless and locked. Assign a co-owner before departure — this step is frequently missed.
AWS key rotation planning
If personal AWS access keys are used in shared pipelines or scripts, deleting them on departure day breaks CI/CD. Engineering needs to identify and replace them with service account keys first.
PagerDuty / on-call schedule update
Paging a non-employee is a visible failure and a compliance gap. Remove from on-call rotations and reassign open incidents before departure — not after.
Shared secret inventory
Identify every shared credential the employee has access to in the password manager. Building this list before departure means you can rotate systematically, not reactively.
Google Workspace account suspension
Suspend — do not delete. Deletion is immediate and irreversible. Suspension preserves email data and Drive files for 30 days. Many organisations retain for 90 days per data policy.
Microsoft Entra ID / M365 token revocation
Disabling an Entra account does not revoke active refresh tokens. Active M365 sessions can continue for up to 24 hours. You must explicitly revoke all refresh tokens via the admin center or PowerShell.
GitHub organisation removal + collaborator check
Removing from the org does not remove direct repository collaborations. Check Settings > Collaborators on each repository separately — especially for repositories added before the person joined the org.
VPN / remote access revocation
VPN access bypasses most application-layer controls. A former employee with an active VPN certificate can access internal systems even after all app-level accounts are disabled. This is the highest-risk gap.
Physical badge deactivation or collection
ISO 27001 A.7.3 requires access to physical premises to be revoked on the termination date. The badge must be collected in person or deactivated remotely the same day — not 'when someone gets around to it'.
Okta / IdP account deactivation
Deactivating in the IdP is the most efficient single action — it revokes SSO access to every connected application at once. If you use an IdP, this should be your first action, not your last.
AWS / GCP / Azure IAM deactivation
Deactivate the IAM user AND delete access keys. A deactivated console user can still authenticate via API if access keys are not deleted. Delete, don't just deactivate.
Device wipe or recovery
Company devices must be retrieved and wiped, or remotely wiped via MDM. An unreturned device with an active session is a data breach risk, not just a compliance issue.
Shared secret rotation
Every secret, API key, and credential in the password manager that the departing employee had access to must be rotated. Not 'soon' — within 24 hours. This is the most commonly deferred action and the highest ongoing risk.
CI/CD personal token replacement
Personal access tokens used in shared pipelines must be replaced with service account tokens. Personal tokens tied to a disabled account will break pipelines — coordinate with engineering.
Salesforce / CRM freeze
Freeze rather than delete. The CRM audit trail (call logs, email correspondence, deal history) must be preserved for legal and compliance reasons. A frozen account cannot log in but its history remains intact.
MFA device revocation
All enrolled MFA factors — TOTP apps, hardware keys, phone numbers — must be removed from the account in the IdP. Registered MFA devices can be used to recover accounts even after password reset.
Email forwarding rule audit
Departing employees sometimes set up forwarding rules to personal email addresses. These rules continue indefinitely after account suspension unless explicitly deleted. Check and remove.
Post-departure audit log review
Check AWS CloudTrail, Google Workspace audit log, GitHub audit log, and Entra ID sign-in logs for any activity from the departed user's account or credentials after the departure date. Any post-departure activity is a security incident.
Shared secret rotation verification
Verify that every secret identified in Phase 1 was actually rotated. Check the rotation log and confirm new credentials are working in all affected systems.
Custom internal tool audit
Check every internal tool not covered in the standard checklist. If a system isn't in the checklist, add it. One missed system is all it takes for a finding or an incident.
How auditors test leaver controls (CC6.3)
SOC 2 and ISO 27001 auditors both test the leaver process — but they test it differently.
What they request
All offboarding records for the audit period. Typically 3–5 individual offboarding checklists selected by sample. HR records to cross-reference departure dates.
What they test
For each sampled departure: was access revoked on or before the last day? Is there a signed checklist? Are there any post-departure sign-ins visible in audit logs?
Admin-specific testing
For any admin-level user who departed: they will specifically test AWS CloudTrail, GitHub audit log, and IdP logs to verify no activity after the departure date.
What triggers a finding
Revocation date after departure date. Missing sign-off. Any post-departure API activity. A checklist that covers email and GitHub but not VPN, physical access, or shared secrets.
Contractor gap
Auditors specifically ask for contractor offboarding records. If you can only provide employee records, the gap will be documented. Contractors need the same checklist.
Evidence beyond the checklist
For high-risk departures (admins, disgruntled employees, involuntary terminations), auditors expect corroborating evidence — an audit log export or IAM export showing the user is absent.
Good vs weak offboarding evidence
The most common offboarding audit finding (verbatim)
"For [N] of [N] sampled terminations, access to [system] was revoked [N] days after the employee's last day of employment. Additionally, no offboarding checklist was on file for [N] contractor departures during the audit period. Management was unable to provide evidence that VPN access was reviewed as part of the leaver process."
— Paraphrased from actual SOC 2 Type II and ISO 27001 audit findings
Automate offboarding with AllowNow — freeFrequently asked questions
How quickly must access be revoked after an employee leaves?
ISO 27001 A.5.18 and SOC 2 CC6.3 both require access to be revoked 'promptly' — in practice, auditors interpret 'on or before the last day of employment' as the standard. For voluntary departures, this means you should have the process ready before the last day. For involuntary terminations (disciplinary, immediate dismissal), access must be revoked within hours — not at end of business day. Any revocation that happens after the departure date will be flagged in a sample test.
Should we delete or disable departing employee accounts?
Disable first, delete later (or never). Immediate deletion loses email history, audit logs, and file ownership — all of which may be legally required. The standard approach: disable or suspend the account on last day, retain for 30–90 days per your data retention policy, then delete. For cloud provider accounts (AWS IAM), deactivate the user and delete access keys — but keep the IAM user record for audit trail purposes.
What's the most common offboarding security incident?
Unrevoked VPN access combined with active API keys. Application-layer access (GitHub, Slack, email) is usually revoked promptly because it's visible. VPN and programmatic API key access is invisible in daily operations but provides full network or API-level access. In security incident post-mortems, these are the most frequently cited vectors for former-employee access incidents.
Does the checklist need to be completed for contractors too?
Yes — and contractors are frequently the gap. ISO 27001 A.5.18 explicitly covers 'all personnel' including contractors. In practice, contractor departures often happen without an HR notification, and IT doesn't learn about the departure until weeks later. Best practice: make contractor offboarding the responsibility of the manager who engaged the contractor, not HR alone.
What evidence does an auditor expect for each completed offboarding?
A signed and dated checklist with a named IT reviewer and HR reviewer. For any system where admin-level access was held: confirmation of revocation (screenshot, export, or audit log entry). For VPN and physical access: a specific record that these were addressed on the last day. The checklist alone is primary evidence — screenshots are secondary evidence to back up any Revoked row that's sampled.
Download the checklist
4 phases, 22 tasks, sign-off fields — no sign-up required.