CHECKLIST

IT onboarding and offboarding checklist

Darshan Savkar (opens in new tab) · Published 17 October 2026 · Last reviewed 17 October 2026 · 3 min read

Why a written checklist matters

Joiners, movers and leavers are where access goes wrong. New starters get copied permissions they don’t need, people who change role keep their old access, and leavers stay signed in to cloud apps for months. A checklist that runs the same way every time fixes all three.

It is also what auditors look for. The CIS Controls ask for a documented process to grant and revoke access (Safeguards 6.1 and 6.2). ISO/IEC 27001:2022 Annex A covers the same ground in controls 5.15 to 5.18 (access control, identity management, authentication and access rights), 5.11 (return of assets) and 6.5 (responsibilities after termination or change of employment).

Before day one

• ☐Get a written request from the hiring manager: name, role, start date, and which systems the role needs.
• ☐Create the account from a role template, not by copying a colleague’s account.
• ☐Assign only the licences and groups the role needs (least privilege).
• ☐Prepare a company-managed device: enrolled in device management, disk encrypted, updates and anti-malware on.
• ☐Record the device and its owner in your asset list.
• ☐Give shared-drive and app access through groups, so it is easy to remove later.

Day one

• ☐The new starter sets their own password and enrols in MFA on first sign-in, with IT on hand to help.
• ☐Set up a password manager for any accounts that can’t use single sign-on.
• ☐Cover the basics: how to spot phishing, how to report a problem, and where company data may and may not be stored.
• ☐Get acknowledgement of your acceptable-use and security policies.

When someone changes role

• ☐Treat a role change as a leave and a join: remove access the old role needed, then add what the new role needs.
• ☐Check admin rights, shared mailboxes and finance or HR systems in particular.

Leaving: on the last day

• ☐Block sign-in on the agreed date and time, and sign the user out of every session. Microsoft 365 and Google Workspace both have an admin control to end all sessions.
• ☐Reset or remove their MFA methods, and revoke app passwords and API tokens they created.
• ☐Remove them from groups, shared mailboxes, distribution lists and admin roles.
• ☐Collect company devices, or remote-wipe any that can’t be returned.
• ☐Change shared passwords they knew, such as Wi-Fi, social media and vendor portals, and update the password manager.
• ☐Check third-party apps that don’t use single sign-on (accounting, CRM, design tools) and close those accounts too.

Leaving: within 30 days

• ☐Hand the mailbox and files to a named owner. Keep the mailbox only as long as you need it, and set an auto-reply pointing to a current contact if appropriate.
• ☐Transfer ownership of documents, calendars and shared links before the account is deleted.
• ☐Free up or cancel unused licences.
• ☐Delete or archive the account and data according to your retention schedule.
• ☐Record what was done and when. That record is your evidence for audits and disputes.

Ongoing: review access

• ☐Review who has admin rights and access to sensitive systems at least quarterly.
• ☐Disable accounts that haven’t been used for 45 days (CIS Safeguard 5.3).
• ☐Compare your account list with HR’s list of current staff and contractors.

Sources

• Center for Internet Security, CIS Critical Security Controls (opens in new tab), version 8.1: Controls 5 (account management) and 6 (access control management).
• ISO/IEC 27001:2022, Annex A controls 5.11, 5.15 to 5.18 and 6.5, available from ISO (opens in new tab).

This guide is general information, not legal advice. Laws and standards change; check the primary sources linked below, and ask your lawyer how they apply to your business. See our editorial and claims policy for how we write and review guides. Found an error? Email hello@zaivit.com with the subject "Correction".