IT Onboarding: Checklist and Process Guide

Every onboarding guide for IT setup starts the same way: "The IT department should provision accounts, configure devices, and brief the new hire on security policies." That is useful advice if you have an IT department. At a small company, the person reading that sentence is also the CEO, the office manager, and the de facto IT department.

This guide is written for that person. The IT onboarding process here runs in three phases, takes about two hours of active time spread across the week before and the week of a new hire's start date, and does not require any enterprise tools or technical expertise. It just requires doing the right things in the right order.

If another founder asked me how to handle IT setup without a specialist, my answer would be short: name one owner, write the list down, and create every account before the new hire arrives. FirstHR is built to run that order as a task workflow with deadlines, and it keeps document signing in the same place.

What Is IT Onboarding?

IT onboarding is the process of setting up technology, devices, software accounts, and system access for new employees before and during their first days at work. It includes hardware provisioning, account creation, security training, and access verification to ensure new hires can be productive from Day 1.

IT onboarding is a specific track within the broader employee onboarding process. General onboarding spans 90 days and covers culture, role expectations, team relationships, and performance milestones. IT onboarding is primarily a Day 1 and Week 1 activity. Both tracks run simultaneously, which is why combining them in a single workflow keeps the technology setup from being left until after the "real" onboarding is done.

Why IT Onboarding Matters for Small Businesses

According to Gallup (2018), only 12% of employees strongly agree that their organization does a great job onboarding new employees (Gallup). A broken IT setup on Day 1 is one of the most visible ways a company ends up in the other 88%.

A new hire who cannot reach their email, the project management tool, or the shared drive wastes their own time and tells the whole team the company is disorganized. That signal is hard to walk back, and the window for walking it back is short.

In a 2019 article, Gallup also reports that about a third of all new employees do not last 90 days on the job (Gallup). That is the same stretch in which an IT setup failure is still the freshest thing that happened to them, which is why early departures can trace back to week one rather than month three.

For small businesses, the IT onboarding failure mode is almost always the same: accounts are created reactively on Day 1 instead of proactively before it. The new hire arrives, and someone scrambles to create an email, request tool access, and find a device. The setup takes three hours instead of ninety minutes, and the new hire spends their first day watching someone else manage IT tickets.

The ripple effects go further than the first morning. A new hire who spends Day 1 waiting for access reads that as a sign of how the company runs, and carries that reading into the next unclear process or unresponsive manager. That first impression colors their entire first 90 days.

IT onboarding also creates a security baseline from day one. Every new employee is a new attack surface: a new set of credentials, a new device on your network, a new person who can be targeted by phishing.

The Cybersecurity and Infrastructure Security Agency (CISA) puts the problem plainly. It warns that bad actors still have ways of getting past even a complex password, and it says that using multifactor authentication makes you 99% less likely to be hacked, because one stolen credential on its own no longer opens the account (CISA).

The fifteen-minute security briefing during IT onboarding is when you close that surface, before it becomes a liability. A new employee who has never been briefed on phishing, who reuses passwords across personal and company accounts, and who has not enabled two-factor authentication (2FA) is exposed from Day 1. The briefing is cheap. The incident it prevents is not.

The Complete IT Onboarding Checklist

This three-phase checklist covers everything from pre-boarding account creation through Week 1 verification. Every item has a clear action and can be completed by a non-technical person.

The most important design principle in this checklist: every item is a concrete action, not a category. "Set up accounts" is not a checklist item. "Create email address in Google Workspace admin panel" is. The specificity is what makes the checklist executable by whoever is running IT onboarding that week, whether it is you or someone you delegated to.

One addition worth making to your checklist: a verification column. After each item is completed, the owner marks it done and the new hire confirms they can access that tool.

This verification column catches the setup errors that only become visible when someone actually tries to log in: wrong email domain, permissions set too low, accounts provisioned in the wrong workspace. Catching these on Day 1 takes two minutes. Catching them on Day 3 when the new hire realizes they cannot access a critical system wastes hours.

How to Run IT Onboarding Without an IT Department

To run IT onboarding without an IT department, keep a master list of your tools, name one owner, and schedule the Day 1 setup as a block on the calendar. The three steps below show how to do that when you are the IT department, the HR department, and the person who also has seven other things to do this week.

The biggest shift in mindset: IT onboarding is a pre-boarding task, not a Day 1 task. By the time the new hire walks in, everything should already be created and waiting. Day 1 is for setup and handover, not for creation and provisioning.

That per-employee document is copied out of a company-level list of every tool you run and who is supposed to have it. Build the list once in the register below, keep the revoke order and the 2FA method on the same row, and each new hire becomes a matter of working down the rows their role needs.

The Small Business IT Tool Stack

A small business IT stack covers six categories: communication, file storage, project management, password management, HR and onboarding, and security. Enterprise IT guides recommend mobile device management (MDM) platforms, identity and access management (IAM) solutions, and single sign-on (SSO) configurations. Most of those tools are overkill for a small company and require technical expertise to configure. Below is the typical stack and the account setup each category needs.

For developer or technical hires, the tool stack expands to include version control, development environments, and deployment tools.

A note on tool sprawl: small businesses accumulate tools faster than they document them. If you have not recently audited your tool stack, the IT onboarding process is a good moment to do it.

Each new hire is a natural audit point: run through every tool the company uses and confirm it belongs on the account creation list. Tools that nobody remembers using still cost you unused seats and add unnecessary attack surface. Prune the list while you update it.

IT Security Basics Every New Hire Should Know

A fifteen-minute security briefing on Day 1 is one of the highest-return activities in IT onboarding. Stolen credentials and phishing are the two failure modes it exists to close, and both are addressed by habits rather than by tooling. You do not need a security consultant to run this briefing. You need to cover four topics and have the new hire acknowledge them.

The password rules above follow CISA guidance, which asks for passwords that are long (at least 16 characters), random and unique to each account, and recommends a password manager to hold them (CISA). A passphrase of four to seven unrelated words satisfies the same standard and is far easier for a new hire to type on Day 1.

The security briefing should end with a signed acknowledgment, even if it is a simple "I have read and understood the IT security requirements" checkbox on the IT policy form. Acknowledgment signals that the rules are real and creates a record that the briefing occurred. This matters if an incident does happen and questions arise about what training the employee received.

Not every control is equally urgent, and on a short Day 1 the order matters more than completeness. Work down this table, then finish whatever is left during week one.

An employee with 2FA on their email and a password manager in place is dramatically more secure than one with neither, whatever else is still outstanding on the checklist. That is the whole argument for doing these four in order rather than attempting all of them at once and finishing none.

Phishing deserves special attention at small businesses because of where it leads: business email compromise. The FBI's Internet Crime Complaint Center (IC3) describes it as a sophisticated scam aimed at businesses and individuals carrying out transfers of funds, frequently after an attacker compromises a legitimate business email account (FBI IC3).

Business email compromise is also where the money goes. According to the IC3's 2025 Annual Report, 24,768 business email compromise complaints reported $3.05 billion in losses that year, second only to investment fraud among the crime types it tracks (FBI IC3).

Brief every new hire on the protocol for financial requests: any request involving money or a change to account details, even from a known address, gets confirmed on a secondary channel before anyone acts. That secondary-channel check is the first tip on the IC3's business email compromise page. A known phone number counts; a number supplied inside the suspect email does not.

IT Onboarding Policy: What to Include

An IT onboarding policy is a written document that defines the rules governing technology use at your company. Every new hire should read and sign it on Day 1. For small businesses, this does not need to be a lengthy legal document. A one-page policy covering six sections is sufficient and will be more consistently read than a twenty-page handbook appendix.

Keep the IT policy in plain language. The goal is comprehension, not legal protection. A policy that employees actually understand and follow is more valuable than one that would hold up in court but gets ignored because nobody can parse it. Have a lawyer review it once when you write it, then update it annually or when your tool stack changes significantly.

The acceptable use section is where most small businesses are too vague. "Use company devices responsibly" is not a policy. A policy specifies: personal use is permitted during non-work hours, prohibited activities include installing unlicensed software and accessing adult content, and the company reserves the right to inspect company-owned devices. That level of specificity feels uncomfortable to write, but it is what makes the policy enforceable and what sets clear expectations from Day 1.

The offboarding section of the IT policy is the one most companies forget to include. Every policy should state explicitly that access will be revoked within 24 hours of termination and that company devices must be returned within a specified timeframe. Having this in a signed policy document simplifies the offboarding conversation and gives you a clear basis for action if a former employee retains access to company systems.

The risk is not hypothetical. CISA documented a case in which a threat actor entered a state government network through the still-active account of a former employee with administrative privileges. Its standing recommendation is that organizations run a continuous user management process so the accounts of offboarded employees are removed and can no longer reach the network (CISA).

Remote and Hybrid IT Onboarding

Remote IT onboarding runs the same three phases as in-person onboarding with additional logistics for physical device delivery and remote configuration. The biggest failure point for remote IT setup is timing: equipment that arrives on Day 2 because someone forgot to order it early enough.

For hybrid teams where some employees are in-office and some are remote, standardize the IT onboarding process regardless of location. Use the same checklist, the same security briefing, and the same policy acknowledgment. The only difference is whether the Day 1 setup session is in-person or via screen share. Standardization prevents the gap where remote employees get less thorough IT onboarding because "we just sent them the instructions."

One remote-specific risk worth addressing explicitly: credential delivery. In-person onboarding has a natural security advantage: you hand the device to the person in front of you and set up accounts together. Remote onboarding requires sending credentials before the new hire can do anything.

Never send passwords in plain text email or Slack. Use your password manager's secure sharing feature, a one-time link service, or a secure note that expires. The new hire should change all provisioned passwords on first login, and that should be a documented step in your checklist, not an assumption.

For fully distributed teams where every employee is remote, consider setting up Apple Business (a free Apple service) or Microsoft Intune with Windows Autopilot for device management. Both allow you to ship a device that self-configures when the new hire powers it on, eliminating the need for manual setup.

The upfront configuration cost (a few hours for someone with basic technical comfort) pays for itself quickly if you hire more than four or five remote employees per year.

Common IT Onboarding Mistakes to Avoid

These four mistakes appear consistently in small business IT onboarding failures. Each one is preventable with a specific process change that takes less time to implement than the mistake costs to fix.

The common thread across all four mistakes: IT onboarding fails when it is treated as a reactive task rather than a proactive process. Each fix above moves the work earlier: accounts created before Day 1, a password manager set up on Day 1 rather than week two, 2FA enabled during setup instead of left to the employee's discretion, and an offboarding list built during onboarding instead of assembled under pressure after a departure.

The checklist does not require more time. It requires doing the same work earlier.

Frequently Asked Questions