Two moments carry real IT risk for a small business: when someone joins and when someone leaves. Get onboarding wrong and a new hire spends their first day locked out and frustrated. Get offboarding wrong and a former employee keeps access to your systems for weeks — a serious security hole. A simple, consistent checklist fixes both.
Why this matters
When onboarding is ad-hoc, new employees wait around for accounts, get handed shared passwords, or receive far more access than they need. When offboarding is ad-hoc — which is more common than most owners realize — departed staff often retain access to email, files, and cloud apps long after they're gone. That's a leading cause of data leaks and, occasionally, sabotage. A repeatable process turns both into a routine, not a scramble.
Onboarding checklist (before day one)
Aim to have everything ready before the new hire arrives:
- Create their accounts — email, computer login, and the specific apps their role needs. Use their own named account, never a shared login.
- Apply least-privilege access. Give access to what the job requires, and nothing more. It's easy to add later; over-provisioning is what gets exploited.
- Prepare their device. Set up the computer with the right software, endpoint protection, and automatic updates turned on.
- Turn on MFA. Enroll them in multi-factor authentication from the start, so security isn't an afterthought.
- Set up a password manager. Give them a company password manager so strong, unique passwords are the default — no sticky notes.
- Grant shared resources — the right shared folders, distribution lists, and tools for their team.
- Brief them on security basics. A short intro to phishing and social engineering on day one sets the tone.
Offboarding checklist (the day they leave)
Speed matters here. The moment employment ends, ideally within the same day:
- Disable their accounts immediately — email, computer login, VPN, and every app. Disabling (rather than instantly deleting) preserves data while cutting access.
- Revoke MFA and reset shared credentials. If they knew any shared passwords, change them now.
- Reclaim company devices — laptop, phone, external drives, security keys, access cards.
- Transfer their data and email. Reassign ownership of their files and set up email forwarding or an auto-reply so client messages aren't lost.
- Remove remote and third-party access. Don't forget cloud services, remote-access tools, and any vendor portals they used.
- Check building and physical access — keys, alarm codes, badge entry.
- Document what was done. A quick record confirms nothing was missed.
The single biggest mistake
Forgetting to remove access on time. It's easy to focus on the emotional or HR side of a departure and leave the IT cleanup for "later" — but later is exactly when the risk lives. Treat offboarding as same-day, every time, no exceptions.
Make it repeatable
The secret isn't memory — it's having the checklist written down and followed the same way every time, whether it's a planned resignation or an unexpected exit. For businesses using cloud platforms like Microsoft 365 or Google Workspace, much of this can be centralized and even partly automated, so granting and revoking access is a few clicks rather than a hunt across a dozen systems.
How Gecadi can help
We help small businesses build and run smooth onboarding and offboarding processes — so new hires are productive on day one and departing staff lose access the moment they leave, with nothing overlooked. Gecadi supports clients on-site across Los Angeles and Orange County and remotely nationwide, 24/7. Want a clean, secure process for staff changes? Get in touch.