An employee leaves on Friday. On Monday everyone is busy reassigning their work, and nobody thinks about their email, cloud drive, VPN, or the password to the company Facebook page. Three months later you discover they're still getting copies of client emails, because at some point they set up forwarding to a personal address. The reverse story is just as familiar: the new hire shows up, the laptop isn't ready, the account has no permissions, and the first two days are spent waiting. Both scenarios have the same fix — a written employee offboarding IT checklist and an equally clear onboarding one.

In this article you'll find ready-to-use lists for onboarding, offboarding and role changes that you can adapt for your company today.

Why an employee leaving is an IT risk

Most former employees have no bad intentions. The problem is that an active account is an open door — whether someone walks through it on purpose, by accident, or because their password leaked online. These are the places where "forgotten" access most often lingers:

Company email, and forwarding rules to personal addresses
Shared folders and cloud drives (OneDrive, SharePoint, Google Drive, Dropbox)
Cloud apps — CRM, accounting software, online banking, invoicing systems
VPN and remote access to the office
The Wi-Fi password and the alarm or door codes
The company's social media profiles and ad accounts
The domain registrar, web hosting and DNS
Vendor, courier and government portals where the employee registered with their personal email

The last two are the most dangerous: if the only administrator of your domain is someone who no longer works for you, one day you may find yourself without a website and without email.

GDPR and the principle of least privilege

The GDPR requires personal data to be processed with appropriate security, including protection against unauthorized access (Articles 5 and 32). A former employee who can still open your customer database is exactly that kind of unauthorized access. If it leads to a data breach, you may have to notify the data protection authority — in Bulgaria, the Commission for Personal Data Protection — within 72 hours. You'll find more on the practical requirements in our article GDPR: Taking Stock Seven Years On.

The good practice that makes both onboarding and offboarding easier is the principle of least privilege: everyone gets access only to what they need for their job. When permissions are granted through groups and roles rather than "by hand" for each person, removing them takes just a few clicks too.

Onboarding IT checklist for new employees

Start preparing a few days before the first working day. HR provides the role, department and start date; IT prepares everything on the list.

Before day one

Create the user account following your company naming standard
Add the user to the groups for their department and role — mail, shared folders, applications
Assign a Microsoft 365 or Google Workspace license and any specialized software
Prepare the laptop or desktop: up-to-date OS, antivirus, disk encryption, company software
Phone, headset, printer access, office key or access card
An asset handover record with serial numbers — you'll need it again at offboarding

On day one

Change the temporary password and enable multi-factor authentication (MFA)
Install and introduce the company password manager
A short security intro: phishing, suspicious invoices, where files are stored, who to call when something goes wrong
Sign the acceptable use policy for IT resources and the confidentiality agreement
Check that everything works — email, VPN, printer, shared folders

During the first month

Review whether permissions match the actual job — no more, no less
Make sure work files are stored in the cloud or on the server, not just on the desktop, where they're left out of your data backups

Employee offboarding IT checklist

Timing matters here. For a planned departure, prepare the procedure in advance and run it on the last working day. For an urgent separation, run it at the moment the decision is communicated.

Disable the account, don't delete it. Deleting can permanently destroy the mailbox and files. Disabling stops access while the data stays intact.
Revoke active sessions. A password change doesn't always sign out devices that are already logged in — Microsoft 365 and Google Workspace have a separate option to end all sessions.
Remove MFA devices and app passwords, as well as any enrolled mobile devices.
Decide what happens to the mailbox. In Microsoft 365 a common practice is converting it to a shared mailbox that the direct manager can access; in Google Workspace, transferring or archiving the data. Set up an automatic reply pointing to a new contact.
Transfer file ownership. Documents in the employee's personal OneDrive or Google Drive must be transferred before the account is deleted.
Remove email forwarding and check for rules that send mail outside the company.
Collect devices using the handover record from onboarding — laptop, phone, keys, cards, USB drives.
Change shared passwords the employee knew — Wi-Fi, alarm, shared accounts, social media.
Remove them from vendor portals, banking systems, courier accounts, the domain registrar and every external service.
Back up and retain the data according to your retention policy, and release the license after the defined period.

The former employee's mailbox deserves special care. It may also contain personal correspondence, so the rules for accessing it should be set out in advance in your internal policies, and employees should be made aware of them. An automatic reply plus manager access to business emails is usually enough.

Role changes: the quiet risk of access creep

When an employee moves from accounting to sales, they usually get the new permissions, but nobody removes the old ones. After a few years that person has access to almost everything. This is called access creep, and it's a common source of data leaks.

On every role change, apply both the onboarding and the offboarding checklist — at the permissions level
Once a quarter or every six months, review who belongs to which groups
Check shared links to documents too — "anyone with the link" doesn't disappear on its own

Who owns the process

The HR + IT pairing works best. HR knows when someone joins, changes roles or leaves; IT knows what needs to be done. Without an automatic trigger from HR to IT, the checklist stays on paper.

Create a template (a form or an email) that HR fills in for every hire, role change and departure
Set deadlines: for example, preparation three working days before the start date and execution on the last day
Keep a register of each employee's accounts and devices
Keep the completed checklist as evidence — it's also useful during a GDPR review

If you already have centralized device and account management, many of these steps take minutes. A well-organized IT environment is also one of the essential cybersecurity measures for any small business.

Frequently Asked Questions

Should we delete a departing employee's account right away?

No. First disable it and revoke sessions, then transfer the mailbox and files. Deletion is the last step, once you're sure nothing important will be lost and the period in your retention policy has passed.

How quickly should IT access be removed when an employee leaves?

Ideally at the end of the last working day, and for an urgent separation, at the moment it's communicated. Every day the account stays active is an unnecessary risk to your company's and your clients' data.

Can we forward a former employee's email to their personal address?

It's not good practice. Business email contains client data and company information, and forwarding it outside the company takes that data out of your control. An automatic reply plus manager access to business emails is the better option.

We're a small company — do we need a written checklist?

Yes, even a one-page one. In small companies especially, one person often has access to everything — from banking to the domain — and a single forgotten password can be costly.

How SNM Support can help

Onboarding and offboarding employees is part of the day-to-day work in SNM Support's subscription IT support. We prepare the computer and accounts before the first working day, and when someone leaves we run the entire checklist — disabling access, transferring email and files, collecting devices and changing shared passwords. We also help you put together ready-made onboarding and offboarding templates tailored to your systems and to GDPR.

Want the process at your company in Sofia to run without gaps? Contact us for a free initial consultation.

IT Onboarding and Offboarding Checklist for Employees