When an employee hands in their notice, most small business owners think about the same things: the final paycheck, the farewell, and who covers their work next week. But there’s one item that gets overlooked far too often — and it can come back to haunt you months later.
Their access to your company’s digital life.
That departing employee may have the password to your email system, your accounting software, your customer database, and the files on your shared drive. In a friendly parting, none of that feels urgent. But months down the road, an unused account is a forgotten back door — and forgotten back doors are exactly what cybercriminals look for. In fact, a surprising number of small business breaches trace back to old accounts that should have been shut off long ago.
Whether the parting is warm or rocky, a simple IT offboarding routine protects your business. Here’s the checklist Frederick County small business owners should run every time someone moves on.
1. Act the Same Day — Not “When You Get Around to It”
Access removal should happen on the employee’s last day, or the moment a termination takes effect. Don’t leave accounts active “just in case you need something from them.” If you need their files later, you can get those without keeping their login alive.
2. Disable Accounts, Don’t Just Change the Password
For every system the employee used — email (Microsoft 365 or Google Workspace), your line-of-business software, your customer database, your website admin — disable or suspend the account. In Microsoft 365, blocking sign-in and converting the mailbox to a shared mailbox is a clean way to keep their messages accessible without keeping the account live.
3. Change Shared Passwords
If the employee knew any password that multiple people share — the Wi-Fi password, the front-desk computer login, a vendor portal — change it. Shared credentials are the single most common hole in small business security.
4. Recover and Secure Company Devices
Get the laptop, phone, or tablet back on the last day. If a device can’t be recovered — or if the departure wasn’t friendly — use your device management tools to remotely wipe company data and remove your business apps. A personal phone that still syncs your company email is a liability sitting in someone’s pocket.
5. Transfer File Ownership Before You Shut Anything Down
Before disabling an account, make sure their documents, spreadsheets, and customer files are reassigned to their replacement or manager. In Microsoft 365 or Google Workspace, an admin can transfer ownership of OneDrive or Google Drive files in a few clicks. Do this first, then disable the account.
6. Remove Them from Shared Inboxes and Distribution Lists
People forget this one constantly. If a former employee is still on sales@yourcompany.com or a team distribution list, they’re receiving customer inquiries — and potentially sensitive information — long after they leave. Sweep every group and shared mailbox.
7. Review What They Could Reach
Take five minutes to check the access logs or ask your IT provider: did the departing employee download large numbers of files recently, or log in at odd hours? This isn’t about suspicion — it’s standard diligence, the digital equivalent of checking that all the keys came back.
8. Write It Down So It Happens Every Time
The biggest offboarding failure is inconsistency. Create a one-page offboarding checklist — physical or digital — and run it for every departure, including contractors and part-time staff. If your business doesn’t have a documented process, you’re relying on memory, and memory fails exactly when it matters.
Friendly Departures Need This Too
Most small business owners skip offboarding steps when someone leaves on good terms. But good terms change. People move on, get new jobs at competitors, or have their old passwords compromised in a data breach at some unrelated service. Locking down access isn’t an insult — it’s just business hygiene, like getting the office keys back.
Make It Easy on Yourself
If this checklist feels like a lot, that’s because doing it by hand is a lot — and easy to half-finish. Many small businesses in Frederick County have West Main Tech handle the whole process as part of managed IT support: same-day account lockdown, file transfers, and device recovery, all documented. One call to (240) 490-9703 and employee departures stop being a security gamble.
Your business’s data is one of its most valuable assets. Don’t leave it in the hands of people who no longer work for you.