IT Offboarding Checklist: A Small Business Guide

When an employee leaves, most small business owners think about the same things: final paycheck, returning keys, maybe an exit conversation. IT access is an afterthought - something you remember two weeks later when you notice the former employee is still in your Slack or still showing up in your Google Drive shared files. Your employee offboarding checklist should include IT steps, but most small businesses treat them separately or skip them entirely.

That is a security problem waiting to become an expensive incident. At companies without a dedicated IT department, nobody owns the IT offboarding process by default. HR handles it, the office manager handles it, or nobody handles it until something goes wrong.

This guide is written for that person at a small business who is not an IT professional but needs to handle IT offboarding correctly. Plain language, specific steps, and guidance for the tools you actually use. At FirstHR, we have helped hundreds of small businesses build offboarding processes that protect them without requiring a technical background.

Why IT Offboarding Matters

Nobody publishes a trustworthy count of how many former employees still hold a live login, and the percentages that circulate online trace back to vendor surveys a decade old. What is documented is how often people leave and what the rules ask of the account they leave behind.

According to the Bureau of Labor Statistics Job Openings and Labor Turnover Survey, 3.1 million US workers quit in July 2026 alone. Every one of those departures landed on somebody who had to remember which systems the person could reach.

For a small business, the math is more personal. A former employee with active access to your accounting software can see your financial data. Access to your CRM means access to every customer relationship you have built. Access to your email means access to ongoing client conversations, contracts, and internal communications.

The exposure is not only financial. A login left open costs you the time to work out what was touched, any regulatory notice you owe, the customer trust you spend explaining it, and your legal position if a former employee uses access you never revoked.

That last part is not theoretical. Under the federal Computer Fraud and Abuse Act, accessing a computer without authorization carries up to a year in prison, and up to five years where it is done for private financial gain. The statute turns on authorization, and revoking the account is what removes it.

Who Handles IT Offboarding at Small Businesses

At enterprise companies, IT offboarding is handled by an IT department with tools like Okta or Microsoft Entra ID (the identity service formerly called Azure Active Directory) that let them disable access to dozens of applications simultaneously with a single click. At a small business, none of that infrastructure exists.

The reality is that at most small businesses, HR or the office manager handles IT offboarding alongside all other exit tasks. That arrangement works fine. The difference between doing it well and doing it poorly is not technical expertise: it is having a system.

If you track access during onboarding, offboarding becomes a checklist exercise. If you do not, offboarding becomes an audit - which takes much longer and misses things. Consider using an onboarding checklist that includes a column for tools and access levels granted to each new hire.

Here is that log as a workbook you can start today. The first tab is one row per person per system, filled in the day access is granted. The second is the inventory of shared logins, which is the part no per-departure checklist can reconstruct after the fact.

IT Offboarding Timeline

IT offboarding has a clear priority order. Not everything needs to happen immediately, but the highest-risk items - access to live systems - must happen on the day of departure. Here is the timeline structured around actual risk level.

Step-by-Step IT Offboarding Checklist

This checklist is organized by priority. Work through it in order - the most critical security steps come first.

Step 1: Notify your team and prepare

Before the employee's last day, confirm the departure date internally and identify who will take over their responsibilities. Build or pull up your access log. The goal is to start the last day with a complete picture of what needs to be done, not to figure it out on the fly.

If you are running a structured offboarding process, this preparation should begin as soon as the departure is confirmed - whether that is two weeks out for a resignation or the morning of for a termination. Use this time to schedule a exit interview and document knowledge transfer before access is revoked.

Step 2: Disable email and set up forwarding

Email is typically the master key to other accounts - password reset emails go there, client communications come in there, and it contains a record of most business activity. Handle it first.

Set up email forwarding before you suspend the account. In Google Workspace, go to Admin Console, select the user, and set a forwarding address before suspending. In Microsoft 365, create a shared mailbox or forwarding rule first, then disable the sign-in. Do not give the departing employee's password to a colleague - use the admin console.

Step 3: Revoke SSO or identity provider access

If your company uses Google Workspace or Microsoft 365 as your primary identity, suspending the user account in the admin console automatically blocks access to Google or Microsoft services. It does not automatically block access to SaaS tools that have their own login - those need to be revoked individually in step 4.

If you use a dedicated SSO tool that sits in front of your applications, disabling the account there can revoke access to all connected apps simultaneously. This is the fastest path if you have it set up.

Step 4: Revoke access to every SaaS tool

This is the most time-consuming step because it must be done tool by tool at most small businesses. Work through your access log methodically. The next section of this guide covers specific instructions for the most common SMB tools.

Do not assume that removing someone from Google Workspace removes them from Slack, Asana, HubSpot, or any other tool that has its own user management. Each requires its own revocation.

Step 5: Change all shared passwords

This step is more dangerous to skip at a small business than at an enterprise company, because small businesses have more shared credentials. See the dedicated section on shared passwords below for a complete process.

Step 6: Transfer files and data ownership

Before suspending the email account or removing the user from cloud storage, transfer ownership of their files. In Google Drive, use the Admin Console to transfer all of a user's Drive files to their manager in one action. In Dropbox Business, you can move files to another team member before removing the user.

If you skip this step and delete the account first, you may permanently lose files the employee created - especially in tools where deleting a user also deletes their content.

Step 7: Collect hardware

Laptops, phones, monitors, peripherals, keys, and access badges all need to come back. For in-person employees, collect on the last day. For remote employees, send a prepaid shipping label in advance and confirm receipt in writing. Do not hold the final paycheck as leverage for a laptop. The Department of Labor notes that federal law sets no immediate deadline but some states require immediate payment, and in those states an unreturned device changes nothing about when you owe the money.

Document the condition of returned hardware. Take photos if there is any damage. This protects both parties.

Step 8: Handle BYOD (personal devices)

If the employee used personal devices for work, you cannot wipe them without MDM tools. See the BYOD section below for what you can and cannot do without technical infrastructure.

Step 9: Reclaim licenses and subscriptions

SaaS licenses cost money. After access is revoked, check each tool to confirm the seat has been freed. Some tools automatically free the seat when a user is deactivated; others require you to manually downgrade your subscription. Also cancel any tool subscriptions or credit cards tied specifically to the departing employee. For a full list of financial and administrative steps, see our employee offboarding checklist.

Step 10: Run a security review and document everything

After completing the checklist, do a final pass. Review recent account activity for anything unusual in the days leading up to departure. Confirm every item on your access log has been addressed. Document the date and time each step was completed - this is your compliance record if questions arise later. Store this alongside your other HR documentation for the employee.

Keeping that record is also a legal minimum once you are large enough. EEOC recordkeeping rules, which reach employers covered by Title VII at 15 or more employees, require personnel records to be held for one year from the date of the personnel action, and for anyone involuntarily terminated, one year from the termination date.

SMB Tools: Access Revocation Guide

The following table covers the tools most commonly used by small businesses and where to revoke access for each. All paths assume you are an admin on the account.

Shared Passwords and Credentials

Shared passwords are the most underestimated IT offboarding risk at small businesses. Enterprise companies solve this with SSO - one identity system that controls access to everything. Small businesses typically have dozens of shared logins that were passed around by email, Slack DM, or sticky note.

When an employee leaves, every shared credential they knew becomes a security risk. This includes team email inboxes, social media accounts, billing and subscription accounts, shipping accounts, vendor portals, and any other shared login that was not managed through a password manager with individual access controls.

The Federal Trade Commission keeps describing the same failure in its security guidance for businesses. In one enforcement matter, a company shared a single cloud administrator credential across employees and outside contractors and never changed it when a contractor left. The agency also tells businesses to limit administrative access to the people whose job actually requires it.

BYOD: What To Do About Personal Devices

BYOD (Bring Your Own Device) is common at small businesses because it saves money on hardware. The tradeoff is that you have less control over company data on personal devices, especially at offboarding. Here is what you can and cannot do without dedicated MDM tools.

For remote employees on BYOD, send written instructions for what needs to be removed and request written confirmation on or before the last day. Ask for it on its own timeline rather than tying it to the final paycheck, which state wage law schedules for you. This creates a record even if you cannot verify enforcement.

Compliance Requirements

Depending on your industry and the type of data you handle, IT offboarding may have specific legal requirements. You do not need to be a compliance expert, but you should know which frameworks apply to your business and what they require at minimum.

Two federal sources are worth bookmarking. NIST publishes the Cybersecurity Framework, now in version 2.0, and its Small Business Cybersecurity Corner curates the same material for companies with no security staff.

The HIPAA rule people most often misquote is the one on termination. 45 CFR 164.308(a)(3)(ii)(C) asks a covered entity to implement procedures for ending access to electronic protected health information when employment ends. It is an addressable specification rather than a stopwatch, so there is no federal 24-hour deadline, but you do have to be able to show what your procedure is.

The deadline in HIPAA sits on the other side of the incident. 45 CFR 164.404 gives a covered entity 60 calendar days from discovering a breach of unsecured protected health information to notify the individuals affected.

Even if none of these specific frameworks apply to your business, maintaining a documented record of your offboarding process protects you legally. The U.S. Small Business Administration tells owners to run access audits on a regular basis so that former employees are removed from their systems. If a former employee later claims they never had access to something, or if a breach occurs, your timestamped offboarding checklist is evidence of due diligence.

For businesses subject to HIPAA or SOC 2, consider involving your legal or compliance advisor to confirm that your offboarding process meets the specific documentation and timing requirements. The cost of a 30-minute consultation is far less than the cost of a compliance violation.

Frequently Asked Questions