--- title: "Employee Offboarding Checklist: Securing Devices and Accounts on Day One" description: FedRAMP gives you four hours to cut off a departing employee. Here is a day-one offboarding checklist for their accounts, devices, and data. image: https://images.unsplash.com/photo-1758691738691-557c09410bf7?auto=format&fit=crop&w=1080&q=80 --- [Skip to content](https://www.phalanxmanagement.com/phalanx-llc-blog/employee-offboarding-checklist-devices-accounts#main-content) ![](https://www.phalanxmanagement.com/hs-fs/hubfs/Circle%20Logo%20White.png?width=5732&height=5732&name=Circle%20Logo%20White.png)Homepage - Home - Products - Pricing - Blog - Company Get started - Home - Products - Pricing - Blog - Company Get started ![employee offboarding checklist](https://images.unsplash.com/photo-1758691738691-557c09410bf7?auto=format&fit=crop&w=1080&q=80) # Employee Offboarding Checklist: Securing Devices and Accounts on Day One ![Josh Caliguire](https://www.phalanxmanagement.com/hs-fs/hubfs/Closeup%202x%202025%20bio.jpg?width=48&height=48&name=Closeup%202x%202025%20bio.jpg) Josh Caliguire October 14, 2026 ## The short answer Cut off a departing employee's access within hours of their last day. FedRAMP, the federal security standard for cloud providers, sets the limit at four hours. Day one comes down to four jobs: shut off sign-ins, take control of the devices, keep the company's data, and write down what you did. Accounts go first, because a live password works from any laptop anywhere. The real risk after a departure is a skipped step, like one forgotten app login or a laptop that never comes back. A written checklist with one owner closes those gaps. **Would your offboarding hold up in an audit?** Answer 10 questions in about 2 minutes. No login. See whether your devices are ready for the next departure. [Take the free MDM Health Check](https://www.phalanxmanagement.com/mdm-health-check) ![Laptop on a wooden desk](https://images.unsplash.com/photo-1496181133206-80ce9b88a853?auto=format&fit=crop&w=1080&q=80) ## Why the first four hours matter NIST's control for personnel termination, PS-4 in [Special Publication 800-53](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final), lists what to do when someone leaves: disable system access, revoke their credentials, hold an exit interview, retrieve company property, and keep access to the information they controlled. FedRAMP applies those controls to cloud providers that serve federal agencies, and it fills in the deadline: four hours. You don't need to be a federal contractor for that number to be useful. It is a clear target that auditors recognize. SOC 2 asks for the same thing in plainer terms. Its access criteria expect you to remove credentials when access is no longer authorized, and to prove it with records. If an audit is coming, our [SOC 2 compliance checklist](https://www.phalanxmanagement.com/phalanx-llc-blog/soc-2-compliance-checklist-what-your-device-management-needs-to-cover) covers the device side. Credentials are still a favorite way in. In Verizon's [2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/), credential abuse was the initial access point for 13% of breaches. A former employee's working password is exactly that kind of credential. ## The day-one checklist Run these in order. The table shows who usually owns each step and how fast it should happen. | Step | What to do | Owner | Target | | --- | --- | --- | --- | | 1. Disable the main account | Suspend the user in Google Workspace or Microsoft Entra ID and sign out every session | IT | Within 4 hours | | 2. Revoke other credentials | Change shared passwords, remove their MFA devices, cancel API keys and VPN access | IT | Within 4 hours | | 3. Remove app access | Check apps outside single sign-on: chat, code, finance, and social accounts | IT and app owners | Day one | | 4. Lock or retire the device | Send an MDM lock or retire command if the laptop is not back yet | IT | Day one | | 5. Keep the data | Transfer files, convert the mailbox, and place a legal hold if needed | IT and HR | Day one | | 6. Recover hardware | Send remote staff a prepaid return box and log serial numbers | Ops or HR | Within 1 week | | 7. Record it | Note each step with a date and a name in a ticket or log | Offboarding owner | Day one | ## Accounts: close the front door first - **Suspend before you delete.** Suspending blocks sign-in right away and keeps the data in place. Deleting too early can take files and email with it. - **End active sessions.** A suspended account can still have open sessions on a phone or browser. Sign them out from the admin console. - **Reset the password, even after converting the mailbox.** [Microsoft notes](https://learn.microsoft.com/en-us/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox) that if you convert a user mailbox to a shared mailbox without a reset, the original username and password keep working. - **Find the logins outside single sign-on.** Any app someone joined with a personal password is a door SSO can't close. A current app list turns this into a five-minute step. ![Sign-in screen with Google and Apple account options](https://images.unsplash.com/photo-1762330469123-ce98036eff16?auto=format&fit=crop&w=1080&q=80) ## Devices: take control before the laptop comes back Remote employees rarely hand a laptop over at the door. That gap is where device management earns its keep. - **Lock it.** An MDM can lock a Mac with a six-digit PIN and a message, and the Mac won't start macOS until someone enters the PIN, according to [Apple](https://support.apple.com/guide/deployment/depb980a0be4/web). Intune offers a remote lock for Windows too. - **Retire or wipe.** In Intune, Retire removes company data, apps, and settings and drops the device from management. Wipe resets it to factory settings ([Microsoft Learn](https://learn.microsoft.com/en-us/intune/intune-service/remote-actions/devices-wipe)). Retire fits a personal device. Wipe fits a company laptop you plan to reissue. - **Save recovery keys first.** Microsoft recommends backing up the BitLocker recovery key and local admin credentials before you retire a device. Without them, you may not get back into a returned laptop. - **Keep Activation Lock under company control.** A Mac still tied to the employee's personal Apple Account can come back locked and useless. [Apple](https://support.apple.com/guide/security/secc46f3562c/web) lets organizations manage Activation Lock through MDM on devices they own. **Could you lock every departing employee's laptop today?** The Health Check covers device visibility, encryption, and onboarding. If you can't name every laptop, that is the finding. [Take the free MDM Health Check](https://www.phalanxmanagement.com/mdm-health-check) ## Data: keep what belongs to the company 1. Transfer Google Drive files to a manager before you delete the account. Google Workspace lets an admin [move file ownership](https://knowledge.workspace.google.com/admin/drive/transfer-drive-files-to-a-new-owner-as-an-admin) in one step. 2. In Microsoft 365, convert the mailbox to a shared mailbox so the team keeps the email history. Without a license, a shared mailbox holds up to 50 GB ([Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox)). 3. Set an auto-reply or forwarding rule for a set period, so customers aren't writing into a dead inbox. 4. If there is a dispute or legal matter, put a hold on the account before anything is deleted. ![Team reviewing notes together at a conference table](https://images.unsplash.com/photo-1517048676732-d65bc937f952?auto=format&fit=crop&w=1080&q=80) ## When a simple checklist is enough Not every company needs automation. If you have fewer than 20 people, everyone signs in through single sign-on, and departures happen a few times a year, a shared checklist and one responsible person can cover it well. The case for automation grows when departures are frequent, staff are remote, or an audit is coming. Then the problem is volume and proof: the step that slips during a busy week, and the record an auditor will ask to see. Our post on [in-house IT vs. managed MDM](https://www.phalanxmanagement.com/phalanx-llc-blog/in-house-it-hire-vs-managed-mdm) runs the numbers on who should own that work. Whichever way you go, write the steps down and name one owner. A common miss is HR assuming IT handled it while IT never heard about the departure. ## FAQ ### How fast should you revoke access when an employee leaves? Within hours. FedRAMP sets four hours for disabling system access, which is a solid target for any company. For a termination, cut access during the conversation. ### Should you delete or suspend a former employee's account? Suspend first. It blocks sign-in right away and keeps files and email in place until you have moved what the company needs. ### What if a remote employee doesn't return their laptop? Lock it through your MDM so nobody can use it, then follow up on the return. If it never comes back, treat it like a lost device and wipe it. ### What does SOC 2 require for offboarding? SOC 2 expects you to remove access when it is no longer authorized and to show evidence that you did. A dated ticket or log entry for each departure is the usual proof. ## Make the next departure the easy one **Find the gaps first** Take the free 10-question MDM Health Check before your next employee leaves. [Take the free MDM Health Check](https://www.phalanxmanagement.com/mdm-health-check) Prefer to talk it through? Book a free consult. We will walk through your current offboarding steps, check which devices you could lock today, and give you a plain read on what to fix first. [Book a free consult](https://www.phalanxmanagement.com/schedule) ## Share this post [mailto:https%3A%2F%2Fwww.phalanxmanagement.com%2Fphalanx-llc-blog%2Femployee-offboarding-checklist-devices-accounts](mailto:https%3A%2F%2Fwww.phalanxmanagement.com%2Fphalanx-llc-blog%2Femployee-offboarding-checklist-devices-accounts) ## Keep reading ### [![Team working on laptops kept SOC 2 audit-ready by device management](https://www.phalanxmanagement.com/hubfs/photo-1522071820081-009f0129c71c.avif) SOC2 MDM Device Compliance How to Prepare Your Devices for a SOC 2 Audit](https://www.phalanxmanagement.com/phalanx-llc-blog/prepare-devices-soc-2-audit) ### [![in house IT vs MDM](https://images.unsplash.com/photo-1522071820081-009f0129c71c?auto=format&fit=crop&w=1080&q=80) In-House IT Hire vs. Managed MDM: The Real Math](https://www.phalanxmanagement.com/phalanx-llc-blog/in-house-it-hire-vs-managed-mdm) [![](https://www.phalanxmanagement.com/hs-fs/hubfs/Circle%20Logo%20White.png?width=5732&height=5732&name=Circle%20Logo%20White.png)](https://www.phalanxmanagement.com/) - Home - Products - Pricing - Blog - Company --- Privacy Policy · Legal · © 2026. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Josh Caliguire", "url" : "https://www.phalanxmanagement.com/phalanx-llc-blog/author/josh-caliguire" }, "dateModified" : "2026-10-14T01:16:06.171Z", "datePublished" : "2026-10-14T01:05:57.000Z", "headline" : "Employee Offboarding Checklist: Securing Devices and Accounts on Day One", "image" : [ "https://images.unsplash.com/photo-1758691738691-557c09410bf7?auto=format&fit=crop&w=1080&q=80" ], "mainEntityOfPage" : { "@id" : "https://www.phalanxmanagement.com/phalanx-llc-blog/employee-offboarding-checklist-devices-accounts", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.phalanxmanagement.com/hubfs/Circle%20Logo%20White.png" } } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.phalanxmanagement.com/phalanx-llc-blog/employee-offboarding-checklist-devices-accounts#post", "@type" : "BlogPosting", "articleSection" : "IT Management", "author" : { "@type" : "Person", "name" : "Josh Caliguire" }, "dateModified" : "2026-10-13", "datePublished" : "2026-10-13", "description" : "FedRAMP gives you four hours to cut off a departing employee. Here is a day-one offboarding checklist for their accounts, devices, and data.", "headline" : "Employee Offboarding Checklist: Securing Devices and Accounts on Day One", "image" : "https://images.unsplash.com/photo-1758691738691-557c09410bf7?auto=format&fit=crop&w=1080&q=80", "keywords" : "employee offboarding checklist, IT offboarding, revoke employee access, device offboarding, MDM offboarding, SOC 2 offboarding", "mainEntityOfPage" : { "@id" : "https://www.phalanxmanagement.com/phalanx-llc-blog/employee-offboarding-checklist-devices-accounts", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "name" : "Phalanx Management", "url" : "https://www.phalanxmanagement.com" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.phalanxmanagement.com/phalanx-llc-blog/employee-offboarding-checklist-devices-accounts#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Within hours. FedRAMP sets four hours for disabling system access, which is a solid target for any company. For a termination, cut access during the conversation." }, "name" : "How fast should you revoke access when an employee leaves?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Suspend first. It blocks sign-in right away and keeps files and email in place until you have moved what the company needs." }, "name" : "Should you delete or suspend a former employee's account?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Lock it through your MDM so nobody can use it, then follow up on the return. If it never comes back, treat it like a lost device and wipe it." }, "name" : "What if a remote employee doesn't return their laptop?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "SOC 2 expects you to remove access when it is no longer authorized and to show evidence that you did. A dated ticket or log entry for each departure is the usual proof." }, "name" : "What does SOC 2 require for offboarding?" } ] } ```