Establish Your Offboarding Rules Early, Preferably Before Someone Leaves

Every organization plans for new hires. There’s a start date, computer setup, and accounts created and ready for day one.

Departures, unfortunately, seem to get far less planning, even though they carry more risk. When staff (or freelancers) leave, a series of decisions need to be made quickly, and those decisions are much harder to reverse than the ones made during onboarding.

Details matter when submitting the request

Recently, a member of our support Team was partway through offboarding a departing employee and stopped to ask a simple question: should this person’s accounts be deleted, or kept? A second question followed. The departing employee’s data was covered by a cloud backup. Should that backup be deleted or archived as a part of the offboarding process?

Neither question had a written answer. The organization had never established standards for how long a former employee’s data should be kept, who should have access to it, or whether any contract or legal obligation required it to stay. So the work paused while the right people were found and asked.

Pausing was the correct call. Guessing would have been worse. If the account had been deleted and the backup removed with it, the only copy of that employee’s email and files could have been gone permanently. Nothing went wrong here, but the situation showed how easily something could.

Why offboarding decisions are important

A departing employee’s accounts hold more than their own work. They often contain client correspondence, contracts, project files, and the history of decisions your organization may need later. Getting offboarding wrong can cause problems in a few ways:

• Lost data. Deleting an account usually deletes everything in it. If no one has moved files or archived the mailbox first, that information may not be recoverable.
• Lingering access. An account that stays active after someone leaves is an open door. Former employees, or anyone who has their password, may still be able to sign in.
• Legal and contractual exposure. Some industries, funders, and client agreements require records to be kept for a set period. Deleting too early can put you out of compliance.
• Unnecessary cost. Software licenses for former employees keep billing until someone releases them.

None of these problems is difficult to prevent. They just require decisions to be made ahead of time instead of in the moment.

Decisions to make in advance

A useful offboarding policy doesn’t need to be long. It needs to answer the questions your IT team will otherwise have to ask every time someone leaves.

• Who can request an offboarding, and how is it confirmed? Account removals should come from an authorized person and be verified before anyone acts. An urgent email asking to shut off or hand over someone’s account is exactly the kind of request attackers try to fake.
• When does access end? Decide whether access is removed at the end of the last day, at a specific time, or immediately in the case of an involuntary departure.
• What happens to email? Options include keeping the mailbox for a set period, converting it into a shared mailbox that a colleague can monitor, forwarding new mail to a manager, or setting an automatic reply that points senders to the right contact.
• Who receives the files? Name the role, usually the manager, that takes ownership of the departing person’s documents before the account is removed.
• How long are backups kept? This is the decision most often missed. Backups are frequently the last copy of a former employee’s data, so set a retention period that meets your organization’s needs, and make sure nobody deletes the backup just because the account is gone.
• What happens to the computer and phone? Decide whether devices are returned, securely erased, and reassigned, and who collects them.
• Which shared passwords need to change? Any shared logins the person knew, such as a social media account or a vendor portal, should be updated after they leave.

Once these answers are written down, offboarding becomes a checklist instead of a series of judgment calls made under time pressure.

The same goes for onboarding standards

Unwritten rules cause trouble on the way in, too. We recently set up a new hire whose email address didn’t follow the naming format leadership believed the organization had adopted. The request form said one thing, and the SOP (standard operating procedure) said another. Either choice was reasonable, but when the onboarding request strays from the established standard, which takes precedence?

Email address formats, which groups new hires are added to, and which applications each role receives are all small decisions. Writing them down once saves time on every hire that follows and keeps your accounts consistent. For more on keeping onboarding from consuming your team’s time, see our post on breaking the fire drill cycle.

How Macktez helps

For organizations whose accounts are managed through a central identity platform like JumpCloud, we can suspend a departing person’s access across connected applications in a single step. That’s the fastest way to close the door when someone leaves. What happens to their data afterward is a business decision, and it belongs to you.

We’re happy to help you draft an offboarding policy that fits your organization. We’ll walk through each decision above, flag any obligations that may affect retention, and turn the result into a checklist our Team follows every time. If you already have a policy, we can review it with you to confirm it covers email, files, devices, and backups.

When someone leaves, the last thing you want is an urgent question with no answer on file. A short conversation now means the next departure goes smoothly.

Schedule a conversation with the Macktez Team to get started.