The Departure That Didn't End
Imagine a scenario that plays out more often than most business owners realize: a trusted employee gives two weeks' notice, HR processes the final paperwork, the team says goodbye over cake in the break room, and life moves on. But three weeks later, that former employee is still receiving company emails forwarded to a personal account — and still has active login credentials to your cloud accounting software.
This isn't a horror story invented to frighten you. It's an illustrative example of a pattern that managed IT providers encounter regularly: the HR offboarding process wraps up cleanly, while the IT offboarding process is left half-finished or skipped entirely. The result is a quietly open door into your business — one that a disgruntled ex-employee, a curious competitor, or a cybercriminal who purchased stolen credentials could walk right through.
For Tampa Bay professional services firms and healthcare practices, where client confidentiality and regulatory compliance aren't optional, this gap isn't just a security inconvenience. It's a liability.
Why IT Offboarding Falls Through the Cracks
Most small and mid-sized businesses have a mental model of offboarding that looks something like this: collect the key card, disable the email account, done. But modern work environments are far more complex than that model accounts for.
Employees today accumulate digital access the way they accumulate sticky notes — gradually, across many systems, often without anyone keeping a master list. Over the course of a year, a single employee might gain access to:
- Microsoft 365 or Google Workspace (email, SharePoint, Teams, Drive)
- Your practice management or CRM software
- Cloud accounting tools like QuickBooks Online or Xero
- HR platforms, payroll systems, and benefits portals
- Industry-specific software (case management, EHR systems, document vaults)
- Shared password managers or internal wikis
- Third-party SaaS tools adopted by individual departments
- Remote access VPNs or remote desktop connections
- Physical access systems tied to digital credentials
When that employee leaves, each of those access points needs to be individually revoked. The problem is that no single person in most small businesses has a complete picture of all those systems. HR doesn't know about the VPN. The office manager doesn't know about the CRM integration the sales rep set up six months ago. And the departing employee certainly isn't going to volunteer the information.
This is precisely the kind of operational and strategic gap that a fractional CTO — a senior technology advisor who works with your business part-time — is positioned to solve. A fractional CTO can establish the governance frameworks, access inventories, and offboarding runbooks that make this process repeatable and thorough, without requiring a full-time hire.
The IT Offboarding Checklist: What Most Businesses Skip
Let's get specific. A thorough IT offboarding process isn't just about disabling one email account. Here's what a well-structured checklist actually covers — and where most businesses drop the ball.
Identity and Access Management
This is the foundation. Every system the employee accessed should be tied to a central identity — ideally through a directory service like Microsoft Entra ID (formerly Azure Active Directory) or Google Workspace's admin console. When that central identity is disabled, access to connected systems is revoked automatically.
In practice, many small businesses don't have true single sign-on in place. That means accounts in individual systems must be manually disabled one by one. Without a complete access inventory, some will be missed.
What to do:
- Disable the primary directory account (Microsoft 365 or Google Workspace) immediately upon departure
- Audit all SaaS applications connected to that account
- Revoke access in any standalone systems not covered by SSO
- Change shared passwords the employee had access to — especially for shared admin accounts
- Remove the employee from any shared inboxes or distribution lists
Email and Data Handling
Email offboarding has its own layer of complexity. Simply disabling an account doesn't address what happens to the messages and data inside it.
What to do:
- Place a litigation hold or export the mailbox before deletion, especially for regulated industries
- Set up an auto-reply or redirect for the departed employee's email address
- Transfer ownership of any shared files, folders, or SharePoint sites the employee managed
- Review calendar entries for recurring client meetings that need to be reassigned
- Audit any email forwarding rules the employee may have created — this is a common data exfiltration vector that's easy to overlook
Endpoint and Device Security
If the employee used a company-owned device, that device needs to be properly wiped and re-provisioned before it's reused. If they used a personal device with access to company systems (a common scenario in small offices), those connections need to be severed remotely.
What to do:
- Remotely wipe or factory-reset company-owned laptops, phones, and tablets
- Remove the device from your mobile device management (MDM) platform
- Revoke any device-based certificates or VPN credentials
- For BYOD situations, use MDM tools to selectively wipe corporate data without touching personal files
- Recover any physical items: keycards, USB tokens, hardware MFA devices
Cloud Storage and Collaboration Tools
This is where the most data leakage happens, and it's the area most businesses overlook entirely.
What to do:
- Review OneDrive, Google Drive, or Dropbox for files shared externally by the departing employee
- Transfer ownership of any documents, folders, or shared drives
- Check Microsoft Teams or Slack for any external integrations or bots the employee configured
- Audit any API keys or developer credentials associated with the employee's account
- Review access to project management tools (Asana, Monday.com, Notion, etc.)
Privileged and Administrative Access
If the departing employee had any elevated privileges — even informally — those need special attention.
What to do:
- Audit admin roles in Microsoft 365, Google Workspace, and any cloud platforms
- Remove the employee from any billing accounts or payment platforms where they had access
- Rotate any shared admin credentials they may have known
- Review whether they had access to your IT vendor's management portal
- Check for any scheduled tasks, automations, or scripts running under their credentials
The Hidden Risk: Departures That Aren't Friendly
The checklist above is important for any departure. But when an employee leaves under difficult circumstances — a termination, a dispute over compensation, a contentious exit — the risk profile changes significantly.
⚠ Illustrative Hypothetical Scenario — Not a Real Case: The following is a fictional example constructed to illustrate a common risk pattern. It does not describe a real firm, real individuals, or a real incident.
A law firm in the Tampa Bay area terminates a paralegal who had been with the firm for four years. The termination is handled professionally by HR, but the IT offboarding is scheduled for the following morning. In those intervening hours, the paralegal downloads a significant portion of the client document vault to a personal cloud storage account.
This type of scenario is entirely preventable — but only if IT access is revoked at the same moment the employment relationship ends, not the next business day. For terminations and sensitive departures, the sequence matters:
- HR and IT coordinate before the conversation happens
- The employee's accounts are disabled at the moment they're notified
- A manager is present to collect devices immediately
- Remote wipe is initiated if the device isn't recovered
This level of coordination doesn't happen by accident. It requires a documented process, clear ownership, and someone with the technical authority to execute it — which is exactly the kind of operational structure a fractional CTO can put in place.
Building a Repeatable Offboarding Process
A one-time checklist is better than nothing. But what protects your business long-term is a repeatable, documented process that runs the same way every time someone leaves — whether it's a planned retirement or an unexpected termination.
Here's what a mature offboarding process looks like:
Access inventory: Every employee's systems access is documented when they're onboarded and updated whenever their role changes. When they leave, this list becomes the offboarding checklist.
Role-based access control: Employees only have access to the systems their role requires. This limits the blast radius of any departure and makes the offboarding list shorter and more predictable.
Single sign-on and directory integration: As many systems as possible are tied to a central identity. Disabling one account cascades across connected systems automatically.
Offboarding runbook: A documented, step-by-step process that HR, IT, and management follow for every departure. It assigns ownership for each step and includes sign-off requirements.
Post-departure audit: A scheduled review (typically 30 days after departure) to verify that all access has been revoked and no anomalous activity occurred.
For businesses without a dedicated IT team, building and maintaining this infrastructure is exactly the kind of work that falls to a managed IT provider or fractional CTO. So you can run your business — and let IT run the way it should. EasyWayIT supports Tampa Bay professional services firms and healthcare practices with proactive monitoring, Microsoft 365 administration, and fractional CTO guidance — making offboarding (and every other IT lifecycle event) more predictable and secure.
What Compliance Requires You to Think About
For businesses operating under HIPAA, the FTC Safeguards Rule, or the Florida Information Protection Act (FIPA), employee offboarding isn't just a security best practice — it's a compliance consideration. These frameworks generally include access control expectations that apply when an employee's authorization changes or ends. Specific obligations vary by situation; consult your compliance advisor to understand what applies to your business.
That means the informal, "we'll get to it Monday" approach to offboarding isn't just a security risk — it may represent a compliance gap that surfaces during an audit or, worse, after a breach.
A thorough IT security assessment can reveal whether your current offboarding process aligns with the access control expectations embedded in the compliance frameworks relevant to your industry. It can also surface any access that was never properly revoked from previous departures — a surprisingly common finding.
Closing the Door Before It Becomes a Problem
With the right systems, documentation, and support in place, offboarding becomes a routine operational step rather than a scramble — and your business data stays exactly where it belongs: inside your business.
If you're not sure whether your current offboarding process covers all the bases, here's a concrete next step: pull up your last three employee departures and ask whether you can confirm — right now — that every system access those individuals had has been fully revoked. If you can't answer that with confidence, you have a gap worth closing.
The best place to start is a structured look at what you have in place today. Get your free IT security assessment and find out where the gaps are before a departure exposes them.