The day someone leaves is the day forgotten access becomes a real risk. Generate a tailored offboarding checklist so nothing, and no one, gets left with the keys.

What it is

A generator that builds a complete, tailored leaver's checklist based on what the person had access to. It covers disabling accounts, recovering devices, rotating shared passwords, revoking building and remote access, reclaiming company data, and the often-forgotten items like cloud admin rights and third-party logins. Print it and work through it on the day.

How to use it effectively

1. Tick what applied to the leaver. Email, admin rights, shared accounts, a company device, building access. The checklist adapts to what they actually had.
2. Act fast, especially for unhappy departures. Disable access on or before the last day. The highest-risk window is right after someone leaves on bad terms.
3. Do not forget the shared secrets. If the leaver knew shared passwords or Wi-Fi keys, rotate them. Disabling their account is not enough on its own.
4. Keep the completed checklist. A signed, dated record shows due diligence if anything is ever questioned, and proves access was properly removed.

Why it matters

Ex-staff with lingering access are a quiet but serious threat, whether through malice or simple oversight. Dormant accounts are also a favourite target for attackers because nobody is watching them. A consistent offboarding process closes that gap every single time, and almost no small business has one written down.