How to Offboard an Employee Securely: A Same-Day Checklist

To offboard an employee securely, disable their identity provider account first, then end active sessions, revoke keys, tokens and shared credentials they knew, transfer ownership of their data, and record the time of each step. Do it on the last day, or immediately for an involuntary exit.

Key takeaways

• Disabling SSO alone leaves API keys, shared passwords and cached tokens.
• NIST SP 800-53 PS-4 requires disabling access, revoking authenticators and credentials, retrieving property and retaining access to information the person controlled.
• OWASP lists improper offboarding of service accounts and keys as the top non-human identity risk.
• Keep a dated record. It is also SOC 2 evidence.

What does NIST say to do?

NIST SP 800-53 control PS-4, Personnel Termination, sets five actions: disable system access within an organization-defined time, terminate or revoke authenticators and credentials, conduct exit interviews, retrieve security-related property, and retain access to information formerly controlled by the person. The time limit is yours to define, so write one in your policy.

What is the order of steps?

1. Disable the user in your identity provider. This cuts SSO apps at once.
2. End active sessions and revoke refresh tokens.
3. Remove MFA devices and security keys tied to the account.
4. Revoke personal access tokens, SSH keys and API keys in code hosting, cloud and CI.
5. Rotate any shared password or secret they knew. Removing them from a vault group does not help if they remember the password.
6. Remove them from apps that sit outside SSO: VPN, vendor portals, billing, social accounts.
7. Transfer files, mailbox, calendar and repository ownership. Then suspend or delete according to policy.
8. Recover laptops and phones, and wipe them.
9. Check again after a day or two for sign-ins or tokens still working.
10. Record the date and time of each step.

Which accounts do teams usually miss?

Anything outside the identity provider. Keys in the person's shell history, tokens stored on their laptop, service accounts they created, and keys used by developer tools. OWASP's NHI1 risk is exactly this: service accounts and access keys not deactivated when no longer needed. AWS also advises updating access keys when an employee leaves.

How does this tie to SOC 2?

Auditors often sample leavers and compare the exit date to the access removal date. Keep the ticket, the identity provider log and the revocation log together. See how to do an access review for SOC 2.

Frequently asked questions

Sources

• NIST SP 800-53 PS-4 text (csf.tools)
• OWASP Non-Human Identities Top 10, 2025
• AWS IAM security best practices

Last reviewed: 19 October 2026.