Cyber Response Systems Notes

The offboarding checklist nobody owns

Hiring has a process because a new person with no laptop complains. Leaving has none because a departed person with too much access says nothing at all.

This post is written in Markdown and uses the post-standard-md layout, to show that Markdown posts get exactly the same treatment as HTML ones.

When someone joins, three people make sure they have what they need, because otherwise they cannot work and they will say so. When someone leaves, their access simply carries on. Nobody is inconvenienced, so nobody notices. We routinely find accounts that have outlived their owners' employment by years.

Why it gets missed

Offboarding falls between HR, who know the person is leaving, and IT, who know what the person could reach. Neither is told to talk to the other. In a small organization both roles may be the same overworked office manager, who was also organizing the leaving drinks.

The checklist

On the last day, before the leaving drinks:

  1. Disable the main account. Disable, not delete. You will want the mailbox.
  2. Sign out every session. Disabling an account does not always end sessions already open on a phone.
  3. Forward or delegate the mailbox to a named person, with an end date.
  4. Remove them from shared vaults in the password manager, and rotate anything they could see.
  5. Collect the hardware. Laptop, phone, door fob, the USB drive.
  6. Go through the list of everything else.

That sixth item is the hard one.

The list of everything else

Every organization has systems that are not connected to the main login: the bank, the payroll portal, the domain registrar, the social media accounts, the alarm company. The only defense is a list, kept current, of who has access to what.

SystemTypical ownerUsually forgotten?
Email and filesITRarely
Accounting softwareFinanceSometimes
BankingDirectorsOften
Domain registrarWhoever set it up in 2012Almost always
Social mediaWhoever was youngest at the timeAlmost always

If the list does not exist, the best time to write it is during a calm week. The second-best time is during the exit interview, with the person who knows.

When the departure is not friendly

Do steps one and two before the conversation, not after it. It feels distrustful. It is also the single piece of advice on this page that people most regret not having taken.

If you would like us to build the list with you, that is part of onboarding.

Cyber Response Systems

Managed detection and response for organizations too small to staff a security desk and too important to go without one.

Get in touch

hello@example.com
+1 555 0100
Mon–Fri, 8am–6pm