When an employee leaves: the first 24 hours

Most departures are amicable. Still, the passwords a person knew, the verification codes that reach their phone and the accounts they own can stay open doors. The problem is rarely bad intent; it is access nobody remembered. This post walks through the first 24 hours, in order of priority.

The first hour: sign them out

• Remove their access to company e-mail, shared folders and group chats.
• End their open sessions on company accounts. Many panels have a "sign out of all devices" option.
• Forward their company e-mail to a manager. Locking the account rather than deleting it means you do not miss important mail later.

The first day: change passwords, but which ones?

This is the hard question. Changing every password they could reach is safest, but in a small team that can be dozens of accounts and work can stall. To prioritise, ask: did they actually see this password?

• If they saw or copied it, changing it is a must.
• If they only filled it with an extension and never saw it, the risk is lower; still change it on critical accounts.
• If they never used it, it can wait.

With passwords shared in a spreadsheet or a chat group you cannot tell: everyone is assumed to have seen everything. Passhield works out, for each item, whether the person saw the password, only used it or never reached it, and splits the offboarding list into required and suggested tasks accordingly.

The first day: move the verification codes

On marketplace, advertising and bank panels, two-step verification is often tied to the person's own phone. When they leave:

1. On accounts tied to the authenticator app on their phone, turn two-step verification off and set it up again.
2. On accounts that send codes by SMS, check the phone number; if it is theirs, move it to a company line.
3. If the recovery e-mail or phone is theirs, update it with company details.

Tying verification codes to something the whole team can reach makes the next departure easier. See our guide to verification codes on shared accounts.

The first week: hand over ownership

Ad accounts, social media pages, shared files and domains the person owned can go unnoticed after they leave. Transfer them to a manager. Some platforms need the old account's approval for a transfer, so start this step before they leave where you can.

Last: write it down

Record every step with its date and who did it. This lets you look back if a problem comes up, and helps document your technical and organisational security measures.

In short

In the first hour close access, on the first day change the passwords they saw and move the codes, in the first week hand over ownership, and record it all. To build your own list, use the offboarding checklist generator.