10 Cybersecurity Steps to Take When an Employee Leaves

From special devices to passwords to confidential information, we often forget just how much access our employees are given regarding the ins and outs of our business. So, what do we do when an employee leaves, or worse, is fired?

With all of this access comes a variety of cybersecurity risks. The last thing you want is to say goodbye to an employee who still has your data within arms reach. Though you might be ending things on good terms, regardless of the situation, there are a handful of things you should be doing when an employee leaves to stay safe from cyber threats.

Here are the ten things we suggest keeping in mind when you’re offboarding a team member.

Conduct an Exit Interview

Once an employee decides to leave, you’ll want to sit down with them, along with your managed IT service provider, to discuss your overall offboarding plan. You’ll need to review which devices they need to return, what accounts they have access to, and how you can reach them should your company need any additional information.

Your employee should have a firm understanding of what they’ll be giving up, so providing them with a list of requirements is always a smart move. Work with your IT provider to ensure all accounts are properly closed, and no box is unchecked regarding cyber safety.

Retrieve All Devices

Phones, tablets, computers, cameras – you name it. All of these devices need to be returned should one of your team members choose to move on. Likewise, anything issued to them should be back in company hands, regardless of its size and whether or not it’s full of sensitive information.

Small items such as external hard drives and flash drives are important to keep in mind as well. If any of these devices are lost or stolen, a data breach can occur, so minimize your risks by conducting a full device audit for each employee.

Deactivate Email Addresses

With most phishing scams taking place over email, you’ll want to deactivate the employee’s accounts on the day they depart. In addition, they should no longer have access to any company information once they’ve left.

Remember: it’s nothing personal. No matter who’s leaving, you need to put the success and safety of your organization first and take the necessary steps to do so.

Change Every Password

After reviewing which accounts your team member has access to, be sure to change their passwords. Make sure all passwords are unique and robust, using the tips we share here.

You may also need to change pins on credit cards or credentials to financial accounts. Dig deep into their access and consider utilizing multi-factor authentication (MFA) moving forward.

Gather All Building Access

Though the COVID-19 pandemic has created a shift in remote working, if your employee still has access to any ID tags or key cards that get them inside your building, it’s time to retrieve them. Only trusted employees should be able to enter your private space.

Let your employee know that as soon as they walk out on their last day, their access will be disabled. Update any codes they were using, such as a door code to get into the office or to access information stored in locked closets or cabinets.

Wipe Devices

After you’ve gathered the proper devices, it’s time to wipe them clean. When your employees bring in their own devices, this can make things more complicated. That’s why it’s always wise to implement a device management strategy alongside your IT service provider.

You should disable all computers, phones, tablets, and more immediately upon an employee’s last day of work. Talk to your IT provider about gathering the necessary data from these devices and how to use them moving forward.

Monitor Things Upon Their Departure

It’s essential to monitor any applications, cloud-based services, and information your team member had access to after their departure. Many cybersecurity experts implement a “trust no one” mindset, noting any signs that their company is at risk of a cyber-attack.

Though you may wholeheartedly trust your employees, this is still a smart move to make, as even the worst of data breaches can happen by accident. Should your employee still have access to something that slipped your mind, an attack can still occur.

You should take all of the necessary steps to protect your company from cybercriminals and their ever-evolving tactics.

Communicate With Your Team

All team members should know when someone will no longer be working with them. This will help prevent any employees from further sharing sensitive information with your departing team member.

Chances are, your employee is on an automatic email list or regularly receives company updates. Whoever is sending this information out must be aware that their team member should no longer have access to these things. No matter the situation, it’s what’s best for your business as a whole.

Inform Your IT Provider

It’s important to communicate all changes with your team members, but your IT service provider should also be at the top of your list when an employee is no longer working for you. They’ll help guide you on best practices and the steps you must take to protect your company.

Remember that your provider is there to help answer any questions you might have regarding cyber safety. In addition, if a team member is leaving on bad terms, they’ll also be there to take the necessary precautions should something go wrong.

Be Proactive

Your offboarding process should be rigorous and easy to implement regarding cybersecurity. The best way to protect your organization is to be proactive about the threats in play – not simply react to them as they attack your business.

Talk to your IT provider about the measures you can use to avoid cyberattacks, keeping your time, money, and reputation in mind.

These measures may include:

• Frequently backing up your systems and installing the latest software updates.
• Enabling MFA across your organization.
• Employing device and data policies, so all team members are aware of the risks they face when sharing confidential information. 
• Using a password manager to store all login credentials safely.
• Training your employees on cybersecurity before they even officially dive into their responsibilities [link to training employees blog when published]
• Learning more about what you can do to prevent cyberattacks.
• Using strong, effective passwords and requiring your employees to change their login credentials regularly.
• Working with a managed IT service provider to create a custom plan that keeps your business safe from cyber harm.

With the number of cybercriminals growing, businesses must keep cybersecurity in mind when offboarding employees. Still have questions about how to do so safely? That’s what we’re here for. Send us a message today!