They Left the Company. Their Access Didn't.

They turned in the keys. Did they turn in the passwords?

In most small businesses, offboarding looks something like this: a farewell lunch, a returned laptop, maybe the office key on the desk. What often doesn't happen is a careful shutdown of every digital account that person could reach.

We see it regularly when we take over IT for businesses around Wesley Chapel and Tampa Bay. Mailboxes for people who left years ago. Former staff still listed as admins. Shared passwords that dozens of past employees once knew.

Why lingering access is a real risk

The concern usually isn't a disgruntled ex-employee, though that does happen. The bigger issue is that unused accounts are unwatched accounts:

•         Old passwords get leaked. If a former employee reused their work password on another site that's breached, attackers can try it on your systems.

•         Nobody notices strange activity. If someone logs into a dormant account, there's no one to see the unusual email or file access.

•         Personal devices stay synced. Company email and files remain on the former employee's phone or home computer, outside your control.

•         Licenses keep running. Unused accounts often keep costing you, and they clutter your security reviews.

The credential leak problem is bigger than many owners realize. Researchers recently found more than half a million exposed credentials still valid after a median of over two years. Accounts nobody is using are exactly the ones nobody thinks to change.

A practical offboarding checklist

Adapt this to your business and run through it every time someone leaves:

1.       Disable core accounts on the last day. Microsoft 365 or Google Workspace first, since email is the key to resetting other passwords.

2.       Revoke active sessions. Signing a user out everywhere prevents an already logged-in device from staying connected.

3.       Remove access to everything else. Cloud apps, CRMs, accounting tools, banking portals, social media pages, and vendor or carrier sites.

4.       Change shared passwords. Wi-Fi, alarm codes, shared mailboxes, and any login stored in a team vault the person could see.

5.       Remove company data from personal devices. Mobile device management makes this a few clicks.

6.       Preserve what you need. Convert the mailbox to a shared mailbox or archive it, and move files to an owner who stays.

7.       Collect hardware and check it. Laptops, phones, security keys, and badges.

8.       Document it. Note what was removed, by whom, and when.

Make it part of HR, not an afterthought

The best offboarding happens because IT is notified before the person's last day, not after. Build a simple trigger: when HR or the owner knows someone is leaving, IT gets a ticket.

For Florida insurance agencies

Agency staff often have access to the agency management system plus a long list of carrier portals. Rule 69O-128.032 expects licensees to limit access to customer information to authorized people. A former producer who can still reach client policies is exactly the gap that rule is meant to close.

Close the door behind them

Pick the last three people who left your business and check their accounts today. It's one of the fastest security wins available.

Main Event Managed Services builds standardized onboarding and offboarding processes for Tampa Bay businesses and agencies. Learn more at maineventmsp.com.