When an employee leaves a company, there is usually a familiar list of things that need to happen. Keys are returned, payroll is updated, benefits are terminated, and perhaps a company laptop or phone gets handed back. Unfortunately, one of the most important parts of employee offboarding is also one of the easiest to overlook: What happens to all of the company’s data and technology the employee could access?
For a small business, the answer can be surprisingly complicated. An employee may have access to company email, shared files, customer information, accounting systems, cloud applications, social media accounts, website administration, vendor portals, remote access tools, and passwords accumulated over years of employment. Proper IT offboarding means knowing what the employee could access, preserving information that belongs to the company, and making sure that access ends when the employee leaves.
The Problem Is Bigger Than an Email Account
Years ago, much of a company’s electronic information might have been stored on an office server. Disabling a Windows account and changing a few passwords could address much of the immediate risk. Today’s small business technology environment is considerably more complicated.
Employees routinely use Microsoft 365 or Google Workspace, cloud file storage, accounting applications, customer management systems, social media, website administration systems, and vendor portals. Many also access company systems remotely or from personal devices. Disabling the employee’s Windows login may prevent access to an office computer, but it does nothing about a cloud application that can be reached from any web browser.
This is one reason businesses looking for small business computer support NJ should consider more than whether someone is available to repair a computer when it stops working. Good IT support also means understanding how a company’s technology is being used, where its information resides, and who has access to it.
Do You Know What the Employee Had Access To?
Ideally, every business would maintain an accurate inventory of its systems and the people authorized to use them. In reality, small businesses tend to evolve organically. A new application gets added because somebody needs it. An employee creates an account with a vendor. Someone receives administrator privileges to solve a problem and keeps those privileges indefinitely.
Five years later, nobody remembers exactly who has access to what.
A proper offboarding process should identify the systems, accounts, applications, devices, and data the employee was authorized to access. That includes obvious resources such as email and company computers, but also cloud applications, remote access, shared passwords, websites, social media accounts, and third-party services.
Preserve Company Data Before Deleting Anything
One of the biggest mistakes a business can make is immediately deleting a former employee’s accounts. Removing access and deleting information are two very different things.
Consider an employee who has worked for the company for eight years. That person’s mailbox may contain correspondence with customers, vendors, employees, attorneys, accountants, and other business contacts. There may be important attachments, historical discussions, purchase information, project records, or documentation that nobody else has.
The same applies to files. Documents may exist in an employee’s OneDrive, Google Drive, local computer folders, network directories, or application-specific storage. Before an account is removed, someone should determine whether business information needs to be transferred, archived, or made accessible to another employee.
This is especially important when an employee handled a function largely independently. If only one person knew where certain files were stored or how a particular process worked, discovering that after the account has been deleted can turn a routine departure into a significant business problem.
Email Requires More Than Changing a Password
Email is usually one of the first systems addressed when an employee leaves, but changing the password may not be enough. Active sessions may need to be revoked, mobile devices may still be connected, multifactor authentication methods may need to be removed, and automatic forwarding rules should be checked.
The business also needs to decide what happens to incoming messages. Depending on the employee’s role, it may be appropriate to forward new email to another employee, provide temporary access to the former mailbox, or configure an automatic response directing customers and vendors to a new contact.
The objective is both security and continuity. The former employee should no longer have access, but customers should not disappear into a digital black hole because nobody is monitoring the old address.
Shared Passwords Create Hidden Risks
Shared passwords are common in small businesses. Several employees may know the login for a vendor portal, social media account, or other service. A website administrator password may have been given to employees and outside contractors over the years.
In those situations, disabling the employee’s individual accounts is not enough. Shared passwords the employee knew may need to be changed.
Whenever possible, systems should use individual user accounts with appropriate permissions rather than one login shared by everyone. Individual accounts make it easier to determine who performed an action and allow one person’s access to be removed without affecting everybody else. A business password manager can also provide a safer way to control credentials that genuinely must be shared.
Don’t Forget Your Website and Online Accounts
Your company’s digital presence may also be vulnerable when an employee leaves. Who has administrator access to your website? Who controls your Facebook page, LinkedIn company page, Google Business Profile, Google Analytics, and Google Search Console? Are those assets controlled through company-owned accounts, or were some created years ago using an employee’s personal email address?
These questions often do not get asked until something goes wrong.
A company’s website and online profiles are business assets. Management should know who controls them and ensure that access is based on company-controlled accounts whenever possible. When an employee leaves, that access should be reviewed just as it would be for an accounting system or company server.
This is more than a cybersecurity issue. It is an ownership and business continuity issue. Losing access to a website, domain, social media account, or Google Business Profile can interfere with marketing and customer communication long after the employee is gone.
Don’t Immediately Reuse the Employee’s Computer
Getting the company laptop or desktop back is important, but resist the temptation to immediately wipe it and give it to the next employee. The computer may contain files that were never stored elsewhere, locally stored email archives, templates, documents, application settings, or other information important to the employee’s successor.
The computer should be secured and reviewed before it is repurposed. Once necessary business information has been preserved, it can be properly prepared for another user.
Personal devices require attention as well. If the employee accessed company email, cloud storage, or other applications from a personal phone or computer, returning company equipment does not necessarily eliminate that access. Remote sessions, synchronized files, VPN accounts, remote support tools, and other forms of access should be reviewed as part of the offboarding process.
Employee Offboarding Should Be a Process
The best time to create an employee offboarding procedure is not at 4:45 on Friday afternoon when someone announces that today is his last day.
Businesses should have a repeatable process that can be followed whenever an employee or contractor leaves. Management and IT should know which systems need to be reviewed, who will preserve necessary data, when access will be terminated, and who will assume the employee’s ongoing communications and responsibilities.
The exact procedure will vary according to the employee’s role. A receptionist, salesperson, bookkeeper, IT administrator, and company president are unlikely to have the same access. The important thing is that offboarding is deliberate rather than improvised.
The same process can also improve employee onboarding. If the business maintains an inventory of the systems and permissions associated with each role, setting up a replacement employee becomes considerably easier.
Small Business Cybersecurity Is About Access
Cybersecurity discussions often focus on antivirus software, firewalls, phishing, ransomware, and other technical threats. Those protections are important, but managing user access is just as important.
Every employee who joins an organization receives a collection of permissions. Every role change may require those permissions to change. Every employee who leaves should trigger a review that removes access that is no longer required.
Most departing employees are not trying to steal company information or damage their former employer. That is not the point. Good security practices should not depend on guessing someone’s intentions. Access should exist because a person currently needs it to perform a job. When that need ends, the access should end as well.
At the same time, the company’s information needs to remain with the company.
Do You Know Where Your Company’s Data Is?
An employee departure can expose technology problems that existed long before the employee gave notice. You may discover that important files were stored in a personal account, nobody knows the administrator password for a critical system, former employees still have active accounts, or a cloud service was created using an email address the company no longer controls.
Small businesses do not need enormous IT departments or complicated corporate procedures to manage employee access properly. They do need to know what technology they use, where their business data resides, who controls it, and who can access it.
Landau Consulting provides computer support and technology consulting for small businesses in New Jersey. We help businesses manage computers, networks, cloud services, security, data, and the everyday technology issues that can become much larger problems when nobody is responsible for seeing the whole picture.
If an employee left your company tomorrow, you should be able to answer two questions: Can that person still access your systems, and can your company still access everything that person was working on? If either answer is uncertain, your employee offboarding process deserves another look.
Contact Landau Consulting to learn how to manage your IT resources when employees leave