Offboarding volunteers and staff: an access checklist for nonprofits

When someone leaves, remove their access on the same day: disable the account, remove them from shared tools, rotate any shared password they knew, and recover devices. Small organizations lose track of access because volunteers come and go, so the checklist matters more than the tools.

Why this goes wrong

People in small organizations wear many hats. A volunteer treasurer may have access to the bank portal, the donor database, the shared drive and the website. Nobody wrote it down. Months later, an old account is still active, and its password may be in a breach somewhere.

CISA's guidance on ransomware stresses least privilege and separate admin accounts. Offboarding is how least privilege survives over time.

Start with a list

You cannot remove what you cannot find. Keep a single sheet:

• Person and role
• Start and end date
• Systems they can reach
• Who approved each access
• Devices they hold

Update it when access is given, not when someone leaves.

The checklist

1. Disable the main account (email and sign-in). Disable, do not delete yet, so you can recover files.
2. Revoke sessions and app passwords where the platform allows.
3. Remove them from shared drives, mailing groups and team chat.
4. Remove them from third-party tools: donor database, payment pages, social media, ticketing, accounting.
5. Rotate shared passwords and shared mailbox credentials they could see.
6. Change who receives their email: forward to a manager for a set period.
7. Collect devices, keys and badges. Wipe or reset after copying needed files.
8. Check that any personal devices lose saved access to organization email.
9. Update the access sheet and note the date.

Part time, seasonal and student accounts

Set an end date when the account is created. A coach's account for the spring season should expire after the season unless someone renews it.

The monthly sweep

Once a month, compare your access sheet to a list of active users in each major system. Anything unmatched gets questioned. This also catches accounts created outside the process.

Admin accounts need extra care

At least two people should hold admin rights to each critical system, so the loss of one person does not lock you out. But keep the admin group small, and review it every quarter.

Quick check

Sources

• CISA: Ransomware guide

Last reviewed: 19 October 2026.