A terminated employee retained access to shared admin credentials and project systems for several days, deleted files, locked accounts, and corrupted a database. The damage reached hundreds of thousands of dollars. The cause wasn't sophisticated hacking or a zero-day exploit. IT assumed HR would trigger the access revocation. HR assumed IT would act once the termination processed. Nobody owned the deadline, so nobody met it.
This checklist addresses the specific gap that creates these incidents: the handoff between HR termination decisions and IT access revocation. If you're pursuing SOC 2 Trust Services Criteria CC6.1 (logical and physical access controls) or ISO/IEC 27001 Annex A.5.18 (access rights), your auditor will ask how you ensure timely deprovisioning. "We have a process" isn't evidence. A completed checklist with timestamps and sign-offs is.
Prerequisites
Before you use this checklist, confirm:
- You maintain a current access inventory. You can't revoke what you don't know exists. This includes VPN, cloud apps, shared credentials, admin consoles, and external vendor portals.
- HR and IT have a defined trigger mechanism. A Slack message doesn't count. You need a ticketing system, an automated workflow, or a signed form that creates an audit trail.
- Shared credentials are documented. If your team uses [email protected] or a shared AWS root account, those credentials must appear in a vault with a change log.
Good looks like: An asset inventory updated within the past 90 days, a ticketing system that auto-creates an offboarding task when HR changes an employee status to "terminated," and a password manager that shows who accessed which shared credentials in the past six months.
Offboarding Checklist
1. HR initiates access revocation within one hour of termination decision.
Create the IT ticket before the termination meeting ends. Include the employee's full name, department, manager, termination date, and whether this is voluntary or involuntary. Involuntary terminations require same-day completion.
Good looks like: The IT ticket exists with a timestamp showing it was opened before the employee left the building. The ticket includes a severity flag that blocks closure until all items are verified.
2. Disable primary authentication within four hours (involuntary) or same business day (voluntary).
Disable Active Directory, Okta, Azure AD, or your identity provider account. Don't delete it yet; you'll need the account for audit logs and access reviews. Disabling prevents login while preserving the authentication record.
Good looks like: Your identity provider shows the account status changed to "disabled" with a timestamp and the admin who made the change. The employee cannot authenticate to any SSO-connected application.
3. Revoke VPN and remote access immediately.
Check your VPN client list, remote desktop gateway, and any jump boxes. If the employee had a personal device enrolled in your MDM, wipe it or revoke its certificate.
Good looks like: The VPN server logs show the employee's last session ended and no new sessions initiated after the disable timestamp. Your MDM console shows the device unenrolled or wiped.
4. Review and rotate all shared credentials the employee accessed in the past 90 days.
Pull the access log from your password manager. If the employee viewed or copied [email protected], root database passwords, API keys, or service account credentials, rotate them. Don't assume they didn't copy them.
Good looks like: Your password manager shows a history of which secrets the employee accessed. Each shared credential accessed in the past 90 days has a new password with a change timestamp after the termination date.
5. Remove the employee from all groups, distribution lists, and shared drives.
This includes Google Groups, Microsoft 365 groups, Slack channels, GitHub organizations, and AWS IAM groups. Group memberships often grant permissions your access reviews miss.
Good looks like: A before-and-after screenshot or export showing the employee removed from every group. Your ticketing system shows this step completed by a named IT admin with a timestamp.
6. Audit direct permissions on high-risk systems.
The employee might have had direct database access, cloud console permissions, or admin rights that bypass group membership. Check your database user lists, AWS IAM user policies, and any admin panels for SaaS tools.
Good looks like: A spreadsheet listing every system where the employee had direct permissions (not inherited through groups), with a column showing those permissions removed and verified by a second person.
7. Revoke API tokens and personal access tokens.
GitHub, GitLab, Jira, and most SaaS tools let users create personal access tokens that bypass SSO. These tokens don't expire when you disable the account. You need to manually revoke them.
Good looks like: You logged into each platform as an admin, navigated to the user's token list, and revoked every active token. Your checklist includes the platform name and the number of tokens revoked.
8. Collect and wipe company devices within 24 hours.
Laptops, phones, tablets, hardware tokens, and access badges. If the employee works remotely, arrange a prepaid return box and track the shipment. Don't wait for the device to arrive before completing steps 1-7.
Good looks like: A shipping tracking number showing the device in transit, or a sign-off form showing the employee returned the device to HR. Once received, IT wipes the device and logs the serial number as "returned and wiped" in your asset register.
9. Document every action with timestamps and responsible parties.
Your auditor will ask for evidence that access was revoked promptly. "We did it" isn't sufficient. You need a ticket history showing who disabled the account, who checked the VPN logs, who rotated the shared passwords.
Good looks like: A closed ticket with a comment thread showing each checklist item completed, the admin who completed it, and the timestamp. Attach screenshots or log exports as ticket attachments.
10. Conduct a 30-day post-termination access review.
Thirty days after termination, pull authentication logs and verify the employee has not logged into any system. This catches missed accounts, forgotten VPNs, or personal devices still enrolled in your MDM.
Good looks like: A report showing zero successful authentications from the employee's username across all systems in the past 30 days. If you find any, investigate immediately and document the finding as a control failure.
Common Mistakes
Assuming SSO disables everything. SSO handles applications that authenticate through your identity provider. It doesn't handle systems with local accounts, API tokens, or VPN clients that use certificate-based authentication.
Waiting for the employee to return the laptop before revoking access. The laptop is evidence of physical asset control, but it's not authentication. Disable the account first. Collect the device second.
Forgetting about non-production environments. The terminated employee might still have access to your staging database, development AWS account, or test Salesforce org. Those systems contain real data and often have weaker monitoring.
Skipping shared credential rotation because "we'll change it later." Later never comes. The employee who viewed the admin password last month still knows it today. Rotate it during offboarding, not during your next quarterly password refresh.
Next Steps
If you're preparing for a SOC 2 Type II audit, your auditor will select a sample of terminated employees and request evidence of timely access revocation. They'll compare the termination date in your HRIS to the account disable timestamp in your identity provider. A gap of several days becomes an observation. A gap of several weeks becomes a deficiency.
For ISO/IEC 27001, Annex A.5.18 requires you to demonstrate that access rights are reviewed and adjusted when employees change roles or leave. Your certification auditor will ask for your offboarding procedure and proof that you follow it. A checklist template isn't proof. Completed checklists with signatures and timestamps are proof.
Run a test termination this quarter. Pick a real employee who's leaving voluntarily and use this checklist. Measure how long each step takes. Identify which systems don't appear in your access inventory. Find out which shared credentials your password manager doesn't track. Then fix those gaps before your next involuntary termination creates a security incident.
