how to run a secure offboarding checklist

how to run a secure offboarding checklist

TL;DR

When someone leaves, kill their access first and ask questions later: identity provider, sessions, tokens, then every system. Rotate anything shared they knew, collect the hardware, and document that it is done. Offboarding is a race against the clock you already lost if you do it next week.

how to run a secure offboarding checklist

Use this when

• An employee resigns or is terminated
• A contractor's engagement ends
• You are building the offboarding process for the first time
• An auditor asks for evidence that departures lose access promptly

Not for this skill when

• Someone is changing teams but staying (that is an access change, not offboarding)
• You need the HR and legal side of terminations (different checklist, different owner)
• Access was already removed and you are investigating past activity (that is an audit)

Steps

1. Disable the identity provider account first.

Everything downstream keys off the IdP: SSO, email, VPN, SaaS. Suspending the IdP account cuts the widest path in one move. For involuntary departures, do this before the meeting, not after.

Expected: the person cannot authenticate to anything via SSO within minutes.

2. Revoke active sessions and tokens.

Disabling the account stops new logins; existing sessions and long-lived tokens keep working until revoked. Kill sessions, revoke OAuth grants, and invalidate API tokens the person held.

idpctl sessions revoke --user [username]

Expected: confirmation that all sessions and grants for the user are revoked.

3. Remove them from every system outside SSO.

GitHub org, cloud console IAM, databases, CI systems, on-call rotations, shared admin accounts they could access. Work from a checklist, not memory, because memory forgets the database nobody uses anymore.

Expected: the username appears in no system access list when you re-pull them.

4. Rotate shared credentials they knew.

Deploy keys, shared service passwords, Wi-Fi passphrases, any secret they ever saw. You cannot un-know a credential, so assume it is compromised and rotate it.

Expected: a list of rotated credentials with dates, none still holding a value the person saw.

5. Collect devices and wipe what you cannot collect.

Laptop, phone, hardware keys, badges. For BYOD or unreachable devices, remotely wipe company data and revoke device certificates. Record serial numbers and return dates.

Expected: every issued device accounted for: returned, wiped, or written off with approval.

6. Transfer ownership of their work.

Docs, dashboards, scheduled jobs, and integrations owned by their account get a new owner before deletion. Deleting the account first orphans all of it.

Expected: no critical asset still owned by the departed account.

7. Do a quick anomaly check on their recent access.

For sensitive departures, review the last 30 days: bulk downloads, odd-hour access, new API tokens created. Most departures are clean; the check is cheap insurance.

Expected: a short note: reviewed, nothing unusual, or findings escalated.

8. Document completion and file it.

Who left, when, what was revoked, what was rotated, what was collected, who signed off. This is the evidence auditors and lawyers ask for.

Expected: one completed checklist per departure, filed where you can find it in a year.

Variant: employee offboarding security checklist

This skill is the checklist. The non-negotiable order: IdP first, sessions second, systems third, shared secrets fourth. Everything else is completeness.

Variant: deprovision user checklist

Same steps, terser: disable, revoke, remove, rotate, collect, transfer, check, file. Print it, laminate it, hand it to whoever runs offboarding.

Variant: what to revoke when someone leaves

SSO account, active sessions, OAuth grants, API tokens, GitHub and cloud access, database users, VPN certs, SaaS seats, on-call memberships, shared credentials. If it authenticates, it is on the list.

Variant: offboarding a contractor quickly

Contractors often have broader access than employees and less notice. Same checklist, faster: IdP and sessions in the first hour, and expiry dates on contractor access from day one so the checklist is mostly verification.

Why this happens

Access accumulates silently and offboarding is always competing with a dozen urgent things, so it slips by days or weeks. Meanwhile the departed account still works, and nobody is watching it. Most "former employee still had access" findings are not malice; they are a checklist that lived in someone's head instead of on paper.

Edge cases and pitfalls

• The departure is hostile: do steps 1 and 2 before notifying the person, have the anomaly check ready, and consider rotating more aggressively. Speed matters more than politeness here.
• Nobody knows all the systems they had: this is why step 3 uses a checklist built from your system inventory. If you do not have an inventory, the offboarding gap will find it for you.
• Shared admin accounts: if five people know the root password and one leaves, rotate it. Better: eliminate shared accounts so departures never trigger mass rotations.
• The person comes back as a contractor: new engagement, new access review, least privilege for the new role. Do not just re-enable everything.
• Offboarding done by an overwhelmed manager: make IT or security own the checklist execution, with the manager confirming. Owners who do not run checklists daily forget steps.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_tr7yHMqntGFH4Czevd7ILw