Employee Offboarding Checklist for Southwest Virginia Small Businesses

When an employee leaves, most small businesses remember the keys, the final paycheck, and maybe the laptop. The technology side is easier to miss, and that is where the real risk sits.

An old Microsoft 365 login, a shared vendor password, a phone that still receives company email, or a former employee’s access to cloud files can quietly become a security problem. It may not be malicious. It may simply be forgotten. Either way, the business is still exposed.

For Southwest Virginia small businesses, the goal is not to build a corporate bureaucracy. The goal is to have a repeatable checklist so access is removed cleanly, company data is retained, and nobody is guessing under pressure.

Start before the last day

Good offboarding starts as soon as a departure is known. Waiting until the final hour creates rushed decisions and missed systems.

Confirm the employee’s final working date and time.
Identify whether the departure is routine, immediate, sensitive, or involuntary.
List the systems, devices, accounts, and vendor portals the employee uses.
Decide who will receive forwarded email, files, voicemails, or customer handoff items.
Set a specific time for access removal instead of leaving it open-ended.

That timing matters. A friendly departure may allow a normal handoff. A sensitive departure may require access to be disabled before the conversation happens.

Disable identity and email access first

The main company identity account should be handled before chasing smaller systems. In most small businesses, that means Microsoft 365, Google Workspace, or another central email and login platform.

Block sign-in or suspend the account.
Reset the password and revoke active sessions.
Remove multi-factor authentication methods tied to the former employee.
Review mailbox delegation, forwarding rules, shared mailboxes, and aliases.
Preserve the mailbox or convert it according to retention needs before deleting anything.

Do not delete the account immediately unless the business already has a retention policy and backup in place. Mailboxes often contain customer history, quotes, project notes, and records the company may still need.

Recover or wipe company devices

Every device should be accounted for: desktops, laptops, tablets, phones, security keys, headsets, docking stations, external drives, and any company-owned network equipment at a home office.

Collect assigned hardware and accessories.
Check whether the device is encrypted.
Back up or transfer business data before wiping or reassigning equipment.
Remove the device from endpoint management, antivirus, remote access tools, and inventory records when appropriate.
For lost or unrecovered mobile devices, perform a remote wipe if management is available.

This is one reason an IT asset inventory matters. If the business does not know what equipment an employee had, it cannot reliably recover or secure it.

Remove access from shared business systems

After the main identity account is secured, work through line-of-business systems. This is where small businesses usually find surprises.

Accounting and payroll platforms.
CRM, quoting, scheduling, and dispatch systems.
Cloud storage such as SharePoint, OneDrive, Dropbox, or Google Drive.
Remote access, VPN, firewall, and building access systems.
Industry-specific portals, vendor dashboards, and supplier logins.
Website, social media, domain registrar, and marketing tools.
Password managers and shared vaults.

If the employee used shared passwords, rotate them. Shared credentials are hard to audit and easy to forget, which is exactly why a password manager with named users is safer than one common login everyone knows.

Protect company data without breaking operations

Offboarding should remove personal access without cutting the business off from its own information. Before wiping devices or deleting accounts, confirm what needs to be retained.

Transfer ownership of shared files and folders.
Preserve project documents, customer records, quotes, contracts, and active work.
Review OneDrive or user home folders for business data that should move to a shared location.
Confirm backup coverage before deleting or archiving accounts.
Document where retained data was moved and who owns it now.

The cleanest process separates employee identity from company data. The employee’s account should not be the long-term owner of documents the business depends on.

Update vendors, clients, and internal handoffs

Technology offboarding is not only a security task. It is also an operations task. If a former employee was the point of contact for vendors, clients, or internal workflows, those relationships need a new owner.

Change vendor account contacts and recovery emails.
Remove the former employee from notification lists and approval workflows.
Update phone routing, voicemail, call queues, and shared inbox handling.
Assign open tickets, projects, and recurring tasks to the right person.
Tell the remaining team where transferred files and responsibilities now live.

A good handoff reduces both security risk and business interruption. People should not have to hunt through an old mailbox to keep serving customers.

Keep a simple offboarding record

Small businesses do not need a 40-page process, but they do need evidence that key steps were completed. A short offboarding record should include:

Employee name and final access date.
Systems disabled or transferred.
Devices recovered, wiped, or marked missing.
Passwords rotated where shared access existed.
Mailbox and file retention decisions.
Person responsible for follow-up items.

This record is useful for audits, cyber insurance questions, internal accountability, and future troubleshooting. It also makes the next offboarding faster.

The practical takeaway

Employee offboarding is one of those tasks that only looks simple when nothing goes wrong. The businesses that handle it well are not lucky; they have a checklist, clear ownership, and an IT partner who knows where access lives.

Tactical Technical Services helps Southwest Virginia businesses build practical IT processes for user access, device management, backups, cybersecurity, and ongoing support. If your business is not sure whether former staff still have access somewhere, that is worth checking before it becomes a problem.

Need a safer offboarding process? Contact TTS for a practical review of your accounts, devices, and access controls.