Before the departure
- Identify the accounts and work the person is responsible for; pick a successor for each.
- Ask whether there is an account only they know about, and move it into a shared vault.
- If verification codes go to their phone, move the code to a shared channel or to someone else on the team.
On the day
- Close their sign-in to company accounts: e-mail, the password manager, shared folders.
- End every open session; browser extensions and mobile apps should be signed out too.
- List the passwords they saw and change them. Critical accounts first: banks, government portals, domains and hosting, payment providers, marketplace panels.
- Re-enrol two-step verification on accounts where they generated codes or saw the verification key.
- Hand over the items they own and the vaults they manage.
- Collect company devices, physical keys and access cards.
For passwords they only used but never saw, a change is recommended; on critical, bank and government accounts, having used them is reason enough to change them.
After the departure
- Renew the shared vault and channel keys the person knew.
- If they were an admin or owner, renew the organisation keys; if an owner, print a new recovery kit.
- Close the process with a report: who did what and when; what was skipped and why.
- Confirm with the institution that personal accounts (e.g. a personal bank user) were closed.
How Passhield makes this easier
Because Passhield records every access with its purpose, it knows which passwords the person saw. When you start offboarding, most of the list above appears as tasks specific to the person; tasks close on their own as passwords change, and the report is ready at the end.