How do you remove an employee's access to accounts when they leave?
Work from one written list of every account the business uses, and remove the person's access the day they leave: email, shared logins, website and hosting, ad and social accounts, payment and booking tools, phones and the business number, and files. NIST's small business guide advises making sure a departing employee no longer has access to the business's information or systems, which it says may involve changing any group passwords they knew.
Start with one written account list
Under the heading "Identify and control who has access to your business information", NIST advises you to determine who has or should have access to your information and technology. To collect that, it says to "review your list of accounts and what privileges those accounts have". As general advice, without a list, removal often depends on memory.
A simple sheet is enough. For each account, record what it is, who can use it, at what level and who can remove someone. Keep it where the owner can reach it, and add a line the day someone gets access. Do not put passwords on the sheet.
The same-day list
Timing here is general advice, not NIST's wording. Plan the list before the last day so that it can be done quickly. For a dismissal, do the email, shared-login and payment steps at the moment the person is told, not at the end of the day:
- Email: change the password, sign out of their devices, and forward or share the mail the business needs before the account is closed.
- Shared logins: change every shared password they knew; NIST suggests changing group passwords they may have known.
- Website, hosting and domain: remove their user, check for other users added in their name, and check who is listed as owner at the domain registrar.
- Ad, social and Google Business Profile accounts: if they are the owner or only admin, transfer ownership to someone in the business first, then remove them. Keep at least two admins from the business.
- Payment and booking tools: remove their access and review recent changes.
- Phones and the business number: change any forwarding to their cell, and collect business phones and devices.
- Files and storage: transfer ownership of documents held in their account, and take back keys, cards and badges.
- Two-step sign-in: move any codes tied to their phone to a device the business controls.
What to do about shared passwords
NIST advises setting up a separate account for each user, contractors included, and notes that without individual accounts it may be difficult to investigate data loss or unauthorized data manipulation. Among the example policy statements in its appendix is "All computer users will have their own account and password".
Where a tool allows it, invite each person with their own login and the lowest level of access that lets them do the job, as the related answers on a Google Business Profile and on ad accounts describe. Where a login really must be shared, a password that the person knew should be changed on the day they go.
Give people only the access they need
Under the heading "Limit employee access to data and information", NIST advises that, where possible, no employee should have access to all of the business's information or systems, only what they need to do their jobs.
What NIST says, and what is general advice
NIST IR 7621 Revision 1 (November 2016) is guidance for small businesses, not a law. On departures it says that removing access may involve collecting their business ID, deleting their username and account from all systems, changing group passwords or combination locks they knew, and collecting keys. NIST mentions deleting the account; it can help to first copy or forward the mail and files the business still needs, then close the account.
Afterward, watch the accounts for activity you do not recognize and tell customers who their contact is now. The related answer on who owns the business phone number covers one account the business should always control.
Sources
Related answers
- How do you give an employee or agency access to your Google Business Profile without giving up ownership?
- Who should own your Google Ads and Facebook ad accounts?
- Who should own your business phone number?
Ongoing technical support
The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.