Hiring and departures create predictable IT tasks, but those tasks often arrive as urgent messages from different people. A shared checklist gives the manager, business owner, and IT contact one record of the requested change, its timing, and what remains incomplete.
Start with an authorized request
Record the employee's role, manager, location, effective date, and required applications. Identify who approves access and who can resolve questions about sensitive systems. Keep employment details that IT does not need outside the technical task record.
For a departure, an authorized business contact must specify when access changes should take effect. IT should not infer that timing from a calendar entry or a colleague's informal message. The same applies when a person changes departments or moves to a contractor role.
Prepare the new employee's working environment
Create the setup around the role's actual tasks. Copying another person's permissions can carry forward access that neither employee needs. Each application owner should confirm the appropriate role or group membership.
Check purchasing and vendor dependencies early enough to resolve them before the start date. Record where the device will be delivered and who will help the employee complete the initial sign-in.
- Approved computer, accessories, and work location
- Email, collaboration, shared files, and business applications
- Required licenses and application-owner approvals
- Agreed device configuration and management
- Multi-factor authentication and approved recovery arrangements
- Support contact and first-day instructions
Validate a real first-day task
Ask the employee or manager to verify a short set of relevant tasks: sign in, open the required application, reach a shared resource, join a meeting, and use any necessary office equipment. The correct test depends on the role.
Close completed items with evidence and give outstanding requests an owner. This prevents a technically created account from being mistaken for a fully working setup. CISA recommends multi-factor authentication, particularly for remote and administrative access; enrollment and recovery need to be included in the setup process.
Separate access removal from preserving work
Before a departure, identify the business records, shared resources, application ownership, and automated processes associated with the person's accounts. The responsible business owner decides what must remain available and who should take over. Access removal and data handling should be documented as separate actions.
Track relevant cloud accounts, local accounts, active access methods, vendor systems, and equipment return. A disabled email account is not evidence that every other system has been handled. Use a secure process for credentials and recovery information; ordinary email or an inquiry form is not the handover record.
Close the loop after a departure or role change
Confirm completed actions against the approved timing, reconcile equipment and licenses, and document decisions still awaiting the business or a vendor. Reusing a device should follow the agreed data-handling and preparation process.
For a role change, check both sides: old access removed where appropriate and new access approved. Review the checklist after a missed dependency so the next employee event benefits from what the team learned.
Continue reading
Sources and further reading
These references support the technical details or service terms above. Check the current documentation when planning a change.