Employee Offboarding Checklist Template

Offboarding crosses HR, payroll, the manager, IT and facilities, so write one procedure with a named owner for each part. The Federal Trade Commission tells businesses to have a procedure that makes sure workers who leave or transfer no longer have access to sensitive information¹.

In the US, the Department of Labor notes that federal law doesn't require an immediate final paycheck, but some states may². Check the rule in the state where the person works. The employee termination checklist template includes a final pay calculation, and a role handover document captures what the person owns and knows.

A checklist written from memory lists the apps someone remembers granting, and an account nobody remembers is an account nobody closes. Build the list for each role from records instead:

• Your identity provider's app list (Google Workspace, Microsoft Entra ID, Okta or similar)
• 12 months of software charges on expense reports and company cards
• Seat lists in the admin consoles of your main platforms
• The person in the role, asked what they signed into last week, including on their phone

Treat every software charge as an app until you rule it out. That's how tools bought on a card turn up. Count the things nobody calls an app, too: a database login, a server key, an old wiki, a customer's own portal and any shared team login.

Include contractors. CISA, the US cybersecurity agency, says organizations should have a defined and enforced process to offboard staff, including contractors and vendors³.

For each account, ask what actually stops the person from getting in. There are three answers, and a line that says "remove access" hides the difference.

Next, count the accounts that need a person: own-password plus shared. That number, not the total, is the size of the last-day job. If an app offers single sign-on but still accepts a password, count it as own-password, because the password keeps working after the main account is gone.

About five months after resigning, a former Cisco employee got into the company's cloud infrastructure without permission and ran code that deleted 456 virtual machines. The Justice Department reports that more than 16,000 Webex Teams accounts were shut down for up to two weeks⁴, and Cisco refunded over $1 million to customers.

NIST, the US standards agency, covers the core in its personnel termination control⁵: disable access, revoke credentials, collect keys and badges, and keep access to what the person controlled. Work in this order:

1. 1

   Disable the main account

   One step closes every single sign-on app. Give it its own line, and confirm it rather than assume it.

2. 2

   End sessions and tokens

   Sign the person out everywhere and revoke app passwords and phone tokens. Disabling the account doesn't always do this.

3. 3

   Remove own-password accounts

   One line per app, each with a named person. Left alone, these keep working.

4. 4

   Change shared logins

   Change each password or key on the planned date, after telling the people who still use it.

5. 5

   Keep their work

   Move their files, mailbox and shared documents to a new owner before you delete or wipe anything.

6. 6

   Collect and wipe devices

   Get back the laptop, phone, badge and keys, then wipe the laptop rather than shelving it.

Sessions need their own step. Microsoft's documentation for Entra ID, its identity service, says access tokens last an hour by default⁶, and that Entra can't directly revoke a session an app issued itself. End sessions in your identity provider, then in any app that keeps its own.

Shared logins need a plan. Changing one locks out everyone else who uses it, which makes it easy to postpone. NIST also calls for a process to change shared account passwords when someone leaves the group⁵. Decide each one in advance: who changes it, on what date, and who gets the new one.

Revoked and confirmed are different states. A console can show an account as disabled while a session, a phone token or a separate password still works. So test each line: try the old login where you can, check the person is gone from the member list (not just marked inactive), or see an empty token list. Record who checked.

Then keep checking. CISA recommends reviewing access and disabling accounts left inactive for a set period, such as 30 days³. Check your last six leavers too. Any account that doesn't close with the main login, or shared password they knew, may still work.

To have River do the sorting, choose Edit with AI at the top of this page. It builds the access matrix from your identity provider export and card statements, then drafts the last-day log for you to check.