Digital footprints cover today's modern workplace. Employees begin making these the moment they're hired. They get a company email address and application logins. They may even update their LinkedIn page to connect to your company.
When an employee leaves a company, digital offboarding must occur. This is the process of "decoupling" the employee from the company's technology assets.
Digital offboarding entails revoking privileges to company data and more to reduce risk.
You don't want a former employee to email all your customers from their work email maliciously. Sensitive files left on a former staffer's computer could leak months later.
20% of surveyed businesses have experienced a data breach connected to a former employee.
WEBIT Services has helped hundreds of clients create IT strategies and prepare against IT interruptions for over 25 years.
By reading this article, you will learn ten steps for successful digital offboarding.
Your Digital Offboarding Checklist
1. Knowledge transfer
Vast corporate knowledge can disappear when a person leaves an organization. So it's crucial to capture this during a digital offboarding process.
The knowledge transfer could be as simple as what social media app someone used for company posts. Or it may be productivity leveraging, such as the best way to enter the sales data into the CRM.
Before an employee leaves, ensure that a knowledge transfer occurs so you have all the details and processes required for the role.
Better yet, have all staff regularly document procedures and workflows. This makes the knowledge available if your resident subject-matter-expert is unavailable to perform those tasks.
2. Address social media connections to the company
Address any social media connections to the former employee.
Is their personal Facebook user account an admin for your company's Facebook page? Do they post on your corporate LinkedIn page?
Examine your company's social media accounts and remove the employee's access to prevent complications or data breaches.
3. Identify all applications and logins the person has been using for work
Hopefully, your HR or IT department will have a list of all an employee's apps and website logins. But you can't assume this.
Sometimes, employees are unknowingly involved in shadow IT and have created work accounts on unauthorized applications. Unfortunately, this is usually done without realizing the security consequences.
Ensure you know of any apps the employee may have used for business activities.
If you plan to continue using the account, change the password so the employee no longer has access. If you do not wish to keep the account, close it after exporting any valuable company data.
4. Change email password
When an employee leaves the company, prioritize changing the employee's email password. This keeps former employees from getting company information and prevents them from emailing as company representatives.
Accounts are typically not closed immediately because emails need to be stored. But you should change the password to ensure the employee cannot access the account or data.
5. Change employee passwords for cloud business apps
Change all other app passwords, including any that might be used on personal or professional devices.
Remember that people often access business apps on personal devices. So, just because they can't access their work computer any longer doesn't mean they can't access their old accounts.
Changing the passwords locks them out no matter what device they are using.
6. Recover any company devices
Remove any company-owned devices from the employee's office or home if the employee is remote.
You should do this as soon as possible to avoid loss of the equipment. Once people no longer work for a company, they may sell, give away, or trash devices.
If a company device has not been correctly wiped, unauthorized users may access company data. So It is crucial to reclaim and properly process company devices.
7. Recover data on employee personal devices
Many companies use a bring your own device (BYOD) policy. It saves money, but this can make offboarding more difficult.
You need to ensure you've captured all company data on those devices. This can be tricky because companies should not erase personal data alongside business data.
8. Transfer data ownership and close employee accounts
Don't keep old employee cloud accounts open indefinitely.
Leaving unused employee accounts open is an invitation to a hacker. With no one monitoring the account, breaches can happen. A criminal could gain access and steal data for months unnoticed.
In response, it's recommended that companies transfer their data from the former employee's account to an approved, existing account. Then, once all the data is transferred, close the old account.
9. Revoke access by employee's devices to your apps and network
Using an endpoint device management system, you can easily revoke device access. Remove the former employee's device from any approved device list in your system.
10. Change any building digital passcodes
Don't forget about physical access to your building. If you have any digital gate or door passcodes, change these so the person can no longer gain entry.
Next steps for a successful digital offboarding
Offboarding is not a comfortable conversation, but it is a necessary process to protect your company from unnecessary risk.
When an employee leaves a company, it's important to close accounts, transfer data, and change passwords to protect your company's reputation and information.
Digital offboarding should include the following ten checklist items:
- Knowledge transfer
- Address social media connections to the company
- Identify all applications and logins the person has been using for work
- Change email password
- Change employee passwords for cloud business apps
- Recover any company devices
- Recover data on employee personal devices
- Transfer data ownership and close employee accounts
- Revoke access by employee's devices to your apps and network
- Change any building digital passcodes
Your IT provider or internal IT team will help with the offboarding process. A quality IT provider or internal team will have a record of all assigned devices, applications, and passwords.
However, if your IT provider or internal IT team is not keeping these valuable records or participating in the offboarding process, it may be time to have a serious conversation about your partnership.
For over 25 years, WEBIT Services has helped hundreds of clients build successful IT strategies and processes while utilizing effective technology.
If you are looking for a new IT provider, schedule a free 30-minute consultation to see how WEBIT can help.
If you're not ready to talk to our team of experts but would like to learn more about IT strategies and services, we recommend the following articles:
