Employee onboarding and offboarding checklist

When someone starts0/6

• Create their own accounts (never share a login), with only the access their job needs
• Turn on two-step sign-in for their email and any other important accounts
• Record the computer, phone, keys, and badges issued to them
• Show them how to spot scam emails and who to call if something looks wrong
• Have them read and sign your computer use policy, if you have one
• Add them to building access (keys, badge, alarm code) as needed

Before their last day0/4

• Confirm the last day, and decide who takes over their work, files, and email
• List every account and system they use, including outside websites and apps
• Note any shared accounts or passwords they know
• Plan where their email will go: forwarded to someone, or kept as a shared mailbox

On their last day (at the time they leave)0/8

Do these the moment they leave. For a difficult departure, do them before the exit conversation.

• Disable their computer and email accounts (disable, don’t delete yet)
• Sign them out of email and apps on every device, and remove their two-step sign-in devices
• Remove access to outside services: accounting, payroll, banking, websites, vendor portals
• Remove their authority to sign or approve payments at the bank
• Remove remote access: VPN, remote-control tools, and any access from home computers
• Collect the laptop, phone, keys, badges, and security keys you recorded when they started
• Remove building access and change alarm codes they knew
• Change any shared passwords they knew, including Wi-Fi and shared accounts

In the weeks after0/4

• Move ownership of their files and shared documents to the person taking over
• Keep the disabled account as long as your records rules require, then remove it
• Update your list of important accounts and who has access to each
• After 30 days, confirm their accounts show no sign-ins since they left