Answers
How to handle a departing employee IT?
When someone leaves your business, their IT access should be reviewed the same day. A simple offboarding checklist helps protect email, files, phones, apps, and customer information without turning it into a crisis.
The short answer
Handle departing employee IT with a repeatable offboarding checklist. The basics are simple. Remove or limit access, collect company devices, save business data, and update who can approve payments, see files, or sign in to key apps.
This matters whether the employee left on good terms or not. Most problems after an employee leaves are not dramatic. They are small gaps, like an old email login still working, a personal phone still getting company messages, or no one knowing where an important file lives.
If you have an independent managed IT provider, often called an MSP, meaning a company that manages and supports business IT on an ongoing basis, they can usually help you build and follow a process. If you do not have one, NodeBridge IT can help you find an independent provider that fits your business.
Why it matters for your business
When offboarding is rushed, access can stay open longer than it should. That can affect email, cloud file storage, accounting tools, customer relationship software, payroll, team chat, phone systems, and remote sign-ins. It can also create confusion for the staff who stay.
There is also a business continuity issue. If one person handled vendor logins, reports, customer files, or a shared inbox, you need a clear handoff. A good process protects the business and helps the next person step in faster.
For some businesses, there are also legal or compliance rules. Requirements vary by industry and state. For example, HIPAA, which is the Health Insurance Portability and Accountability Act for protecting health information, or PCI, which refers to payment card security requirements, may affect how access should be managed and documented.
What good looks like
Good offboarding starts before the last day if possible. Decide the exact time access should change. In some cases, that is the end of the workday. In other cases, it needs to happen immediately. Then use one checklist that covers people, devices, accounts, and data.
At a minimum, review email, file storage, business apps, accounting systems, payroll, remote access, mobile devices, and any physical keys or badges. Disable or reset sign-in access where needed. Multi-factor authentication, or MFA, means a second step beyond a password, like a code on a phone. That should be removed from the former employee's personal device and moved to the right business owner or current staff member.
Collect company-owned laptops, phones, tablets, and keys. An endpoint means any device that connects to your business systems, like a laptop, desktop, or phone. Make sure each endpoint is accounted for, returned, and reviewed before being reused.
Save business information before accounts are closed if needed. That includes email, shared documents, browser bookmarks, notes, and files tied to customers, projects, or vendors. The goal is not to keep personal material. It is to retain business records and make sure the team can keep working.
A practical offboarding checklist for small businesses
You do not need a giant policy to start. You need a short, consistent list that someone owns. In many small businesses, that owner is the office manager, operations lead, or business owner, working with outside IT support if needed.
Use this as a starting point, then tailor it to your business and the apps you actually use.
- Set the departure date and exact time access should change.
- Make a list of every system the employee used, email, file storage, payroll, accounting, scheduling, customer tools, chat, phone system, remote access, and industry-specific software.
- Disable or change sign-in access for key accounts.
- Review shared mailbox access, calendar access, and forwarding rules.
- Remove access from personal phones and tablets used for company email or apps.
- Collect company devices, chargers, keys, badges, and security tokens.
- Confirm who now owns important files, customer relationships, and vendor contacts.
- Save needed business data from the employee's accounts before closing them.
- Update approval rights for bills, payments, refunds, payroll, and bank-related workflows.
- Change shared passwords that the employee may have known. Avoid shared passwords where possible.
- Update team contact lists, emergency contacts, website staff pages, and voicemail greetings if needed.
- Document what was removed, what was collected, and what still needs follow-up.
Common gaps owners miss
Many businesses think only about the employee's computer login. In real life, the bigger gaps are often in cloud apps and third-party services. Think email newsletters, payroll portals, online banking contacts, shipping accounts, appointment systems, point-of-sale tools, social media, domain registrar access, and phone carriers.
Another common miss is shared access. If several people know the same password, one employee leaving is a sign to change it. A cleaner setup is role-based access, where each person has their own login and only the access they need.
You should also know whether your IT support uses tools to manage devices. For example, RMM means remote monitoring and management, which is software an IT provider may use to watch device health and perform support tasks. EDR means endpoint detection and response, which is software that helps detect suspicious activity on devices. If your provider uses those tools, they should know which devices and user accounts need to be updated when someone leaves.
Patching means applying software and security updates to devices and systems. If a returned laptop sat unused for a while, it may need review and updates before another employee uses it. This is one reason a clear inventory of devices matters.
When to get outside help
If your business has more than a handful of employees, uses many cloud apps, handles sensitive data, or has turnover across multiple locations, it is worth having a formal process. A good provider can help you map your systems, create an offboarding checklist, and make sure responsibilities are clear.
Some businesses also want broader guidance on planning, budgeting, and risk. You may hear the term vCIO, which means virtual Chief Information Officer. That is a strategic IT planning role some providers offer. It can help a growing business set policies for onboarding, offboarding, software access, backups, and device replacement.
Backups matter too, but they are not the same as offboarding. The 3-2-1 backup approach means keeping 3 copies of data, on 2 different types of media, with 1 copy kept offsite. That can support recovery after a problem, but it does not replace access reviews when someone leaves. Also, no honest provider promises zero downtime or an unhackable network.
If you are not sure what level of support you need, start with our answers or browse common services. If you want help finding an independent managed IT provider, get matched. NodeBridge IT is a free matching service. We do not manage, monitor, secure, repair, or access your systems.
An honest note
NodeBridge IT is a free matching service, not an IT provider. The information here is general and educational — confirm scope, SLAs, and price in writing with any provider before you sign. No one can guarantee uptime, security, or recovery.
When an employee leaves, use a simple checklist to remove access, collect devices, and protect business data the same day.
Common questions
Should we turn off access before the employee's last day ends?
It depends on the situation and the role. For a routine departure, many businesses change access at the end of the last workday. For a higher-risk situation, access may need to change immediately. Plan the timing in advance.
What if the employee used their personal phone for company email?
Make sure company email and business apps are removed from the personal device, and move any MFA methods to the right person. If you use a mobile device management tool, your IT provider can advise on the cleanest process.
Do we need to keep the employee's email account active?
Sometimes for a short period, yes, especially if customer messages or approvals still arrive there. A common approach is to retain needed business records, set an appropriate transition message, and route important mail to a current staff member.
Who should own the offboarding checklist in a small business?
Usually one internal person should coordinate it, often the owner, office manager, HR lead, or operations manager. Outside IT support can help with the technical steps, but someone in the business should make sure the whole list gets completed.
We do not have an IT person. Is that a problem?
Not necessarily, but it makes a written checklist even more important. If your business relies on many apps, remote work, or sensitive customer data, it may help to work with an independent managed IT provider so offboarding is handled consistently.
Is this something every business should document?
Yes. Even a very small company should have a basic written process for departures. It saves time, reduces confusion, and lowers the chance that old access stays open.
Ready to find a managed IT provider that fits?
Get matched, free, with independent managed IT providers near you. You compare scope, response times, and price — and you choose who to hire. We never ask for passwords or system access.