Use employee offboarding as a coordinated security change, not an HR form. At the separation deadline, disable the person’s identity and physical access; revoke sessions, tokens, keys and application grants; rotate shared secrets; recover devices; preserve and transfer business records; and verify every control with timestamped evidence. This checklist covers developers, product staff, contractors and other workers who can reach source code, cloud systems or confidential plans.
What a complete offboarding checklist must achieve
A completed offboarding record should let an independent reviewer answer five questions:
As an Amazon Associate I earn from qualifying purchases.
- When was the separation decision made, and what exact time did access have to end?
- Which identities, repositories, cloud accounts, portals, devices and physical locations did the person use?
- Were direct access, delegated access and credentials outside the main identity system all revoked?
- Were mail, files, code, product plans and other records preserved and transferred before deletion?
- Who verified the result, what evidence was retained, and which exceptions remain open?
Account disablement is only one control. A developer can still have a personal access token, SSH key, OAuth grant, deploy key, service-account credential, private fork or local copy after the directory account is disabled. GitHub’s guidance places responsibility on the organization to ensure that people who lose repository access delete confidential information and intellectual property. That makes post-removal review essential, not optional.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall1. Prepare and classify the separation
Create a single offboarding record
Open a ticket or case as soon as HR or management issues the separation notice. Record the employee’s name, manager, employment end time, work location, employment type, systems used, repositories, cloud accounts, customer and partner portals, and the data classifications involved. Include contractors and temporary staff; their accounts are often administered outside the normal HR identity flow.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Assess risk before notifying the wider team
Have HR, the manager and security classify the event. Consider access to production, signing keys, customer data, trade secrets, financial information, unreleased products, privileged administration and regulated or classified systems. Notify legal, IT, facilities, payroll and other responsible offices as appropriate. The CISA Interagency Security Committee checklist specifically calls for notifying relevant offices and conducting a risk assessment.
For an involuntary or high-risk exit, agree on the cutover time and limit notice to people who must execute the plan. Do not send a broad announcement before the identity and physical-access actions are ready. Note the time zone and whether the deadline is immediate, end of shift or another policy-defined point.
Assign owners and a fallback
Name an owner for each action: HR for the separation record, IT or identity administrators for accounts, security for credentials and verification, engineering for repositories and deployment systems, facilities for badges and keys, the manager for property and records, and legal for holds and retention. Identify a backup administrator in case the primary operator is unavailable. Pre-authorize emergency action for a high-risk termination so an approval bottleneck does not leave access active.
2. Set a revocation deadline that matches the risk
Write the deadline into the ticket before execution. CISA’s covered high-risk separation checklist calls for immediate revocation of access to classified information and secure facilities and for disabling access to government systems and facilities within one hour of separation notification. NIST Special Publication control PS-4 instead requires an organization-defined period, so employers must set and document their own standard for ordinary cases.
| Separation condition | Required timing from the cited guidance | How to apply it |
|---|---|---|
| Covered high-risk or classified-information case | Immediate for classified information and facility access | Coordinate the cutover before notification and execute at once. |
| CISA covered government-system case | Within one hour of separation notification | Use a named incident-style operator and record completion timestamps. |
| Other organizational separations | An organization-defined period under NIST PS-4 | Set the period in policy and apply a shorter deadline when the risk assessment warrants it. |
Use the same deadline for digital and physical controls unless a documented exception is approved. A person who can no longer sign in but still holds a badge, hardware token or laptop remains a risk.
3. Disable identity, sessions and authentication methods
Execute the identity shutdown in a fixed order, then confirm it from an administrative view:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Disable the directory or identity-provider account. This should block primary authentication and single sign-on.
- Invalidate active sessions. Revoke refresh tokens, browser sessions, device sessions and remembered sign-ins; disabling the account alone may not terminate an already-issued session.
- Remove group memberships and privileged roles. Check administrator, production, finance, security, repository-owner and emergency-access groups.
- Disable remote paths. Turn off VPN, remote desktop, bastion, virtual desktop and other remote-access methods.
- Revoke authenticators and recovery methods. Remove MFA devices, backup codes, recovery email addresses, phone numbers, app passwords and hardware authenticators.
- Revoke application grants and credentials. Remove OAuth consents, API keys, personal access tokens, SSH keys, certificates and service credentials associated with the individual.
- Disable non-SSO accounts. Check email, cloud consoles, HRIS, ticketing, CRM, build systems, package registries, collaboration tools and vendor portals.
Keep the identity record long enough to support legal holds, audit and investigation. Do not delete it merely because sign-in is disabled.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Close source-code and engineering access
Repository and organization membership
Remove the person from every code-hosting organization, team and repository. Review direct membership, outside-collaborator status, repository-owner rights, branch-protection administration, issue and project permissions, package registries, artifact stores and deployment environments. Remove deploy keys, machine users and automation identities created for the person’s work.
Tokens, keys and OAuth applications
Search the code-hosting audit log and identity inventory for personal access tokens, fine-grained tokens, OAuth applications, SSH keys and cloud roles. Revoke each item rather than assuming that account disablement handles it. GitHub warns that revoking a fine-grained token does not necessarily stop SSH keys created by that token; perform a separate key review and access test.
Forks, mirrors and local copies
Inspect private forks, internal mirrors, archived repositories and code-hosting organizations outside the main enterprise. A removed member may retain a local clone, and private forks can preserve access in some configurations. Ask the manager and departing worker to identify local worktrees, removable media, scripts and external accounts that contain company code. Apply the organization’s confidentiality, retention and deletion rules; do not rely on a platform’s membership list to prove that every copy is gone.
Rotate shared secrets
Change any secret the worker could know or reach: production passwords, database credentials, signing keys, deployment keys, VPN certificates, registry credentials, cloud access keys and vendor credentials. Prioritize secrets that are shared, long-lived, embedded in scripts or used by automation. Update dependent services, test the replacement, and record the old secret’s retirement so a failed rotation does not silently break production.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems5. Preserve and transfer product plans and business records
Inventory the information
List product roadmaps, specifications, prototypes, pricing, launch calendars, customer research, contracts, board materials, strategy documents, dashboards, calendars, tickets and automation. Include information in personal workspaces, shared drives, team sites, notebooks and external portals.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Transfer ownership before removing access
Assign named successors for documents, repositories, dashboards, calendars, automations and vendor accounts. Test that the successor can open, edit or administer each item at the required level. Preserve comments, version history, issue links and approval records where they are business records.
Apply retention and legal holds
Ask legal whether a litigation hold, investigation hold, regulatory requirement or contractual retention rule applies. Preserve mailbox and cloud-file content before deleting or converting the account. Microsoft’s “Remove a former employee – Overview” procedure, published or updated January 5, 2026, covers preserving mailbox and OneDrive content, transferring access, handling mobile devices, forwarding or converting mailboxes and account deletion. NIST PS-4 likewise requires retaining access to organizational information and systems formerly controlled by the terminated individual. There is no single retention period that applies to every employer; use your policy and the applicable hold.
6. Recover and sanitize devices and physical property
Use a handoff list with asset identifiers, condition, date, recipient and administrator:
- Laptops, desktops, phones and tablets
- Removable drives and other storage media
- Hardware tokens, smart cards and card readers
- Badges, facility passes, keys and alarm credentials
- Certificates, manuals and security-related equipment
Revoke device certificates and remove the device from management enrollment. Wipe or re-enroll managed devices according to the organization’s endpoint policy and preserve evidence if an investigation is open. For CISA’s covered cases, government equipment, credentials, card readers, PIV cards, keys, IT systems and identification or facility passes are to be returned within the specified one-hour window. NIST treats retrieval of security-related system property as a termination control.
7. Conduct a focused exit interview
The exit interview is a security control as well as an HR conversation. Explain continuing confidentiality, intellectual-property, trade-secret, acceptable-use and security obligations. Where policy, contract, clearance or law requires it, obtain an acknowledgment or debriefing signature.
Ask specific questions rather than relying on “Have you returned everything?”:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Which company data, repositories, devices, credentials or local copies did you use?
- Did you create scripts, scheduled jobs, OAuth applications, service accounts or automations?
- Do any company files exist in personal cloud storage, email, removable media or external code-hosting accounts?
- Which customer, partner or vendor portals did you access?
- Are there keys, tokens, certificates, badges or devices not listed in the inventory?
Record the answers and route newly identified credentials or copies to the relevant owner immediately.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →8. Verify every control and retain evidence
A checklist item is not complete because an administrator clicked “remove.” After execution, security or the system owner should verify:
- The identity account is disabled and all active sessions are invalid.
- MFA devices, recovery methods, application passwords and delegated grants are removed.
- Repository, cloud, VPN, email, CI/CD and package-registry access tests fail for the former identity.
- Personal access tokens, SSH keys, OAuth apps, cloud roles, service accounts and external-organization memberships have been reviewed.
- Shared secrets were rotated and dependent systems continue to work with the replacement.
- Mail, files, code, product plans and other retained records are accessible to named successors.
- Devices, badges, keys and tokens are accounted for, sanitized or escalated as exceptions.
Record timestamps, administrators, ticket numbers, verification results, ownership transfers, retained data, exceptions and unresolved external accounts. Attach audit-log exports or screenshots where policy permits. Have security or the system owner sign off that the post-removal review is complete.
9. Use different branches for common separation scenarios
Planned resignation
Use the policy-defined end time, transfer records and ownership in advance, and schedule credential rotation so the handoff does not disclose unnecessary information before the final working moment. Keep the same verification standard as any other departure.
Involuntary or high-risk separation
Limit notification, coordinate the cutover with HR and security, and execute digital and physical revocation together. Prioritize production, signing, customer-data, classified and facility access. Preserve logs before making changes that could affect an investigation.
Recommended Free Tools
Contractor or external collaborator
Review sponsor-managed accounts, personal email invitations, customer portals, outside repository organizations and shared credentials. Confirm the sponsoring manager has transferred records and recovered property, even when the contractor never appeared in the HRIS.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Leave of absence or temporary suspension
Do not treat a temporary suspension as a termination. Apply the organization’s approved hold procedure, document the expected return date and preserve ownership and records without deleting information that must remain available.
10. Select an implementation workflow that can prove completion
Whether the process is manual or automated, evaluate it against these practical capabilities:
- Time to revoke access across SSO and non-SSO systems
- Visibility into repositories, tokens, forks and service accounts
- Device and physical-property tracking
- Legal-hold and retention support
- Approval and separation-of-duties controls
- Audit evidence and timestamped sign-off
- Failure handling when an API, administrator or external portal is unavailable
- Coverage for contractors and partner accounts
Automation should create tasks, enforce deadlines and collect evidence, but it should not hide exceptions. Require an explicit owner when a system cannot be reached, and keep the unresolved item visible until it is verified or formally accepted by the appropriate authority.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →11. Common failure modes and fixes
“The directory account is disabled, so we are done.”
Fix: review sessions, tokens, SSH keys, OAuth grants, forks, local copies, service accounts and external organizations separately.
“We deleted the mailbox immediately.”
Fix: check legal holds and retention requirements, preserve content, transfer access and document the successor before deletion or conversion.
“The laptop was returned, but nobody checked the cloud.”
Fix: combine property recovery with identity, repository, cloud and vendor-portal verification; physical custody does not revoke remote credentials.
“The token was revoked, but deployment still works.”
Fix: investigate SSH keys, deploy keys, machine users and shared secrets. A fine-grained-token revocation may not disable an SSH key created by that token.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“The manager said access was removed.”
Fix: require an approved administrative test and retain the timestamp, operator and result. Verification is the completion criterion.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
