Guide
Staff Onboarding and Offboarding: Getting IT Access Right
Access should start on day one and end on the last day. Former staff who can still sign in are one of the most common audit findings.
Why it matters
Most access problems start when someone joins or leaves. Former staff who can still sign in are one of the most common findings in audits and insurance reviews, and shared logins make it impossible to know who did what.
Step by step
- Give every person their own account. No shared logins.
- Grant only what the role needs, and set up MFA on day one.
- Before someone leaves, list every system and portal they use.
- On the last day, disable sign in, collect devices and change shared passwords they knew.
- Review licenses after 30 days and cancel what is unused.
Common mistakes
- Shared logins for systems or vendor portals
- Disabling email but forgetting bank, payroll and vendor portals
- Leaving forwarding rules that send mail outside
- Paying for licenses nobody uses
Free tools for this
Staff IT Onboarding and Offboarding
Accounts, devices and access done right on the first and the last day.
MFA Readiness Checklist
Get every person ready for MFA, with the methods ranked strongest first.
Questions people ask
What is MFA, and why does it matter so much?
Multi-factor authentication adds a second step after your password, such as an app approval or a security key. Most account takeovers start with a stolen password, and MFA stops a stolen password from being enough.
Should we still make staff change passwords every 90 days?
No. NIST updated its password guidance in August 2025: require a change only when there is a sign the password was exposed. Long passphrases beat complex short ones, new passwords should be checked against lists of known breached passwords, and MFA plus a password manager matter far more than forced resets.
Not sure where to start?
One conversation and a straight answer about where your organization stands. No cost, no commitment, no pitch.