Employee Offboarding Procedure

Employee Offboarding Procedure

Authorized By: [Board, CEO, or other senior official who has reviewed and approved the policy]

Purpose/Overview

When employees are no longer employed or affiliated with the organization, all organizational assets must be recovered access to the organization’s systems must be properly and completely revoked. The purpose of this procedure is to ensure those goals are met.

Scope

This procedure applies to the offboarding of all employees.

Procedure

Compliance

Identify organizational assets that have been issued to the employee and ensure they are recovered

• Laptop

• Mobile Phone

• ID Card/Badge

• Parking Tag

• Keys

• Disable the employee’s account in Active Directory 1. Login to portal.office.com as an administrator with user access

2. Click the menu icon in the upper left-hand corner

3. Select the Admin center

4. From the left-hand menu, select Users, then Active Users to see a list of accounts

5. Scroll down to the employee’s account and click on their name

6. Click the “Block Sign-in” button at the top of the screen that pops up

7. Click the “Sign out of All Sessions” link

• Remove the licenses assigned to the employee 1. If the screen referenced above is not open, follow steps 1-5 above

• 2. Click the “Licenses and Apps” tab near the top

3. Remove (un-check) the licenses assigned to the employee

4. Click Save Changes

• Ensure mailbox permissions are properly removed 1. If the screen referenced above is not open, follow steps 1-5 under “Disable the employee’s account in Active Directory”

2. Click the “Mail” tab near the top

3. Remove any “read and manage”, “send as”, and “send on behalf of” permissions for the employee’s mailbox

4. Remove any E-mail forwarding that may be in place

Revoke externally-shared file privileges

• 1. If the screen referenced above is not open, follow steps 1-5 under “Disable the employee’s account in Active Directory”

• 2. Click the “OneDrive” tab near the top

3. Remove all external shares of the user’s files

Revoke access to other external systems

QuickBooks

1. Login to QuickBooks using an account with administrator access.

2. Revoke the user’s privileges if they exist. User accounts should not be removed from the system.

• Salesforce.com

• 1. Login to Salesforce.com using an account with administrator access.

2. Revoke the user’s privileges if they exist.

• Github

• 1. Login to GitHub using an account with administrator access.

2. Revoke the user’s privileges if they exist.

• Change access codes on all physical security items (e.g., electronic locks)

Compliance Measurement

[Describe how the organization will measure compliance. A policy that cannot be measured will inherently be ineffective.]

The CISO and/or the CISO’s team will verify compliance to this policy through various methods, including but not limited to periodically auditing the list of users in each internal and external systemand validating that only current employees have access to those systems. Compliance will also be verified through walk-throughs, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner.

Exceptions

[List any exceptions to the policy. The number of exceptions should be kept to the absolute minimum (ideally no exceptions should be granted). If numerous exceptions are needed, consider revising the policy.]

Any exceptions must be approved by the Policy Owner in advance.

Non-Compliance

[Describe how the organization will deal with any noncompliance. Policies that are not enforced will inherently not be followed.]

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

[Insert list of other, related standards, policies, plans, and procedures]

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page