Small business security
What to revoke when someone leaves
Most small businesses have at least one former employee who could still log in to something. Not out of malice — nobody made a list, the leaving was busy, and the account was never anyone's job to close.
Dormant accounts belonging to people who no longer work for you are one of the most common ways small businesses get compromised, and one of the easiest to fix. The attacker is rarely the ex-employee. It is whoever eventually buys their reused password from a breach dump and finds it still works.
Disable, do not delete
The instinct is to delete the account and be done. Do not — at least not on day one.
Deleting a mailbox destroys mail you may need, breaks files shared from that account, and removes the audit trail that tells you what happened if a problem surfaces later. Disabling achieves the security outcome immediately and keeps everything else intact.
Revoking sessions matters as much as disabling. A signed-in phone can keep working for hours or days after an account is disabled, because the app is holding a token that has not expired yet.
The list, in priority order
Within the hour
- Email and directory account — disable, then explicitly sign out of all sessions
- Mobile device access — revoke the device, and remote-wipe company data if the phone was theirs
- VPN or remote access
- Password manager — remove from the shared vault, and note which shared passwords they could see
- Anything financial — banking, payment processor, expenses, payroll
Within the day
- Cloud file storage — and reassign ownership of files they created, or those files vanish when the account is finally deleted
- Customer records and CRM
- Accounting software
- Social media, including any personal account with access to your business page
- Website, hosting, domain registrar and DNS
- Any third-party tool they signed up for — design software, scheduling, project tools, AI subscriptions
Within the week
- Shared passwords they knew — change them, because removing a person from a vault does not un-know a password they memorised or wrote down
- Building access — door codes, alarm codes, keys, fobs
- Recurring billing in their name — subscriptions on a personal card get cancelled when they stop being reimbursed, and something breaks a month later
- API keys and integrations they created, which keep working long after the human account is gone
The four that are always missed
Accounts that are not in your directory
Disabling someone in Microsoft 365 or Google Workspace does not touch the twelve services they signed up for with their work email. Those are separate logins with separate passwords, and they stay live.
The practical way to find them is to search the mailbox for "welcome" and "confirm your email" before you disable it. It is not elegant, and it works.
Personal devices holding company data
If work email was on a personal phone, company data is on a device you do not own. Address this in writing before someone is hired, not on the day they leave. Mobile device management makes it a single remote wipe of company data only; without it you are relying on goodwill.
The things named after them
A shared inbox forwarding to their address. A calendar owning recurring client meetings. A domain registered on their personal account. An analytics property where they are the only administrator. Each surfaces weeks later, usually at an inconvenient moment.
The recovery contact
If their personal email or phone is set as the recovery contact on any business account, they retain the ability to reset it. This is the one that turns an ordinary departure into a genuine problem, and almost nobody checks it.
Make it a checklist, not a memory
The reason offboarding fails is never that people do not care. It is that it happens rarely, under time pressure, and depends on somebody remembering a list that exists only in their head.
Write it down once. Keep it with the joiner checklist, because the two mirror each other: everything granted on the way in has to be removed on the way out, and the joiner list is where you find out what those things were.
When the departure is not friendly
Everything above moves to before the conversation rather than after it. Disable access while the meeting is happening, not at end of day.
This feels cold, and it is standard practice for good reason. Preserve logs, change shared credentials rather than only removing the person, and check for forwarding rules or exports created in their final weeks. You are not accusing anyone by following a process you follow every time.