Small business security
The IT and security steps for staff starting and leaving
Most small businesses are good at the welcome lunch and the farewell card. The IT side is often rushed: new starters share someone else’s login, and former staff keep access to email, files and social media for months. A simple checklist for both ends fixes that.
The short version
The essentials
- Every person gets their own accounts, never a shared login.
- Give only the access each role needs.
- Remove access on the person’s last day, not weeks later.
- Change any shared passwords they knew.
Before someone starts
Create their own accounts
Set up a personal email account and logins for each system they need. Avoid shared logins, which make it impossible to know who did what and hard to remove access later.
Give access based on the role
Start with the minimum they need and add more when it’s needed. Use groups or roles (for example “Accounts” or “Sales”) rather than setting permissions person by person.
Prepare their device
Set up their laptop and phone before day one, with updates, encryption and security tools in place. See our new laptop checklist.
Turn on MFA from the start
Require two-step verification on their first sign-in, and help them set it up in person.
On their first day
- Walk through how to report a suspicious email or call, and who to tell.
- Explain your payment verification rule if they handle money. See invoice scams.
- Show them the password manager and how shared passwords are handled.
- Explain where files should be saved so they’re backed up.
- Point them to any acceptable use or AI use guidance.
When someone leaves
Plan the exit before their last day, and do the access removal on the day they finish. For an unplanned or difficult departure, remove access at the time you tell them.
Disable their accounts
Block sign-in for their email and work accounts, and sign them out of all sessions. In Microsoft 365 and Google Workspace, an admin can do this in one place.
Keep their data, don’t delete it
Convert their mailbox to a shared mailbox or delegate it to a manager, and transfer ownership of files. Set an auto-reply pointing to the right contact. Keep it for an agreed period before deleting.
Remove access to everything else
Go through the systems list: accounting software, CRM, banking, payroll, supplier portals, social media, website and domain accounts, remote access, building access and alarm codes.
Change shared passwords
Change any shared password they knew, such as Wi-Fi, admin logins or shared accounts. A team password manager makes this much easier.
Recover devices and wipe personal phones
Collect laptops, phones, keys and security keys. If they used a personal phone for work email, remove the work data or account through your device management tool.
Transfer ownership
Make sure the business, not the person, owns accounts like social media pages, domain registrations, app stores and software subscriptions.
Keep a systems list
A simple spreadsheet listing every system, who has access and who is the owner makes offboarding much quicker and much less likely to miss something.
Checklist
| Task | Starter | Leaver |
|---|---|---|
| Email and main work account | Create with MFA | Block sign-in, revoke sessions, convert mailbox |
| Business apps (CRM, accounting, payroll) | Add to the right role | Remove or deactivate |
| Shared passwords | Share through the password manager | Change any they knew |
| Devices | Prepare and assign | Collect, wipe and reassign |
| Social media, domain, website | Add personal admin access if needed | Remove access, confirm business ownership |
| Physical access | Issue keys or codes | Collect keys, change codes |
Common questions
Should we delete a former employee’s email account?
Not straight away. Keep the data for business and legal reasons, then delete when you no longer need it, in line with your retention practices.
What about contractors?
Same process, with an end date set when you create their access, so it expires automatically if possible.
How do I know what access someone has?
That’s what the systems list is for. If you don’t have one, start it now with your next onboarding.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.