Are you Creating Risk When you Offboard Workers?

The employer/employee relationship is a marriage of sorts. When a couple gets divorced, they usually remove each other from their various shared accounts including financial, credit, and social media. They also prohibit access to each other’s computers. The same goes when an employee leaves your company – they should not be free to play in your sandbox anymore.

Digital footprints abound in the modern workplace. As soon as you hire someone, they begin leaving their footprints - from company email addresses, application logins, and even social media like LinkedIn.

But when an employee leaves a company, there is a process that needs to begin immediately: The process of ‘decoupling’ the employee from the company’s technology assets. Complete and thorough digital offboarding is vital to Cybersecurity.

There are a few reasons that departing employees can cause disruptions: harboring a grudge, stealing data for profit, or using their work email to maliciously email all your customers and vendors – or maybe or to ‘poach’ your clientele to their new company. Any sensitive files left on a former staffer’s computer could leak months later.

Of businesses surveyed by LLCBuddy.com, 20% have had a data breach involving a former employee.

You need to do more than just revoke privileges to company data when you’re digitally offboarding. Successful offboarding is a critical process to go through to reduce risk concerning any former staff member.

Here’s a handy checklist to help you cover all your bases:

Knowledge Transfer

Important corporate knowledge can disappear when a person leaves an organization. It’s crucial to capture this during the digital offboarding process.

Knowledge of this type can be in different forms, from something as simple as what social media app someone used for company posts to the best way to enter the sales data into the CRM. Is the departing employee the ‘go-to’ person for any applications or processes? You do not want to find out that nobody knows how to perform a function after the employee leaves.

Cover your bets by having all staff regularly document procedures and workflows. Be sure to do a knowledge download with an employee during the exit interview. This makes the knowledge available if the employee is not there to perform those tasks.

Examine Social Media Connections to the Company

Are there social media connections to the former employee? Is their personal Facebook user account an admin for your company's Facebook, Twitter, You Tube, or LinkedIn page? Was posting on those sites one of their duties? Not only would these duties need to be reassigned, but all connections need to brought under the corporate umbrella.

Identify All Apps & Logins the Former Employee was Using

Hopefully, your IT services team or your HR department will have a list of all the apps and website logins that an employee has. Be sure – don’t just assume this. Employees often use unauthorized cloud apps to do their work (known as Shadow IT). This is usually done without considering the Cybersecurity consequences.

Keep track of any and all apps that employees may use for business activities. You will need to address these. Change the login if you plan to continue using them. Or you may want to close them altogether after exporting company data.

Immediately Change Email Login Credentials

This is often the only thing managers think they need to do after an employee departure – and it is necessary. Changing the employee’s email password should be one of the first things you do. This keeps a former employee from getting company information. It also keeps them from emailing as a representative of the company.

It takes a little time to close these accounts because emails need to be stored, but it must be done as quickly as possible. If the employee was in sales, incoming emails may have considerable value – re-ordering merchandise or accepting a proposal for services so automatic forwarding should be set up.

Change All Logins Everywhere!

The emails are just the first, but your entire infrastructure needs to be cleansed of all login credentials/passwords the former employee could use. Remember that people often access business apps on personal devices. Just because they can’t access their work computer any longer, it doesn’t mean they can’t access their old accounts from other devices. Make sure this is covered.

Once you change the passwords, you lock them out no matter what device they are using. The process can be simplified with a single sign-on solution.

Recover All Company-owned Devices

It is important to recover any company-owned devices from the departing employee’s home, and do not delay in doing so. Do it as soon as possible to avoid the loss of the equipment. Once people no longer work for a company, they may sell, give away, or even toss the devices in the trash.

Recover All Company Data on Employee Personal Devices

Be sure to recover and wipe personal devices of all company data, even if your company uses a Bring Your Own Device (BYOD) policy. BYOD saves money, but it adds extra steps to efficient and thorough offboarding.

Ensure that you’ve captured all company data on those devices. If you don’t already have a backup policy in place for this, now is a good time to create one.

Close Employee Accounts and Transfer Data Ownership

Departing employee cloud accounts need to be closed ASAP. Choose a user account to transfer their data to and then close the account. Leaving unused employee accounts open and unmonitored is an invitation to a hacker. With no one monitoring the account, breaches can happen. Completely unnoticed, a criminal could gain access and steal data for months.

Deny Employee’s Devices Access to Your Apps and Network

If you use an endpoint device management system, you can easily revoke device access. Remove the former employee’s device from any approved device list in your system.

Change Building Digital Passcodes

It’s not all cyber - revoke physical access to your building as well. If you have any digital gate or door passcodes, be sure to change these so the person can no longer gain entry.