Security Basics 09｜The first thing to do on someone's last day: close the account, not collect the laptop

It is a colleague's last day. At half past five the admin team works down the leaver's form and takes back the company laptop, the door card and the office keys, and everyone says goodbye with a smile. The handover may feel watertight — but at nine that evening, if he sits down at the computer at home and opens a browser, he can still sign in to the company website's back office, the customer management system, and even the cloud server and the source code repository.

Because in the cloud era a company's assets are no longer locked in an office drawer or inside that physical laptop. They are tied to online accounts and access keys, one by one. This is the ninth piece in our security basics series, and the first of part two, on accounts and passwords. Having worked through your system assets and the boundaries of responsibility in Security Basics 01｜An advisory just landed: how do you know whether it affects you and the pieces that followed, this one deals with an order that is very easy to get backwards on the day itself: close the accounts first, collect the laptop after.

Why collecting the laptop is not the same as withdrawing access

Company files used to live on the office network or on an individual's hard drive, so once the person walked out of the door and handed the machine back, they could no longer touch company data. But your business system, website back office, cloud drive and messaging groups are all on the internet now, and any phone or home computer with a connection can get in with nothing more than a username and a password.

What deserves more attention is that disabling his company mailbox does not automatically invalidate his accounts on the other systems:

• Back-office accounts that stand on their own: the website admin area, an e-commerce system, an advertising account. If each is signed into with its own separate password, closing the company mailbox will not stop him signing into any of them.
• Phones and home browsers left signed in: some systems keep a session alive for a good while once signed in. Even if you change the password, unless the system forces every signed-in device off, his phone may still be showing the latest data.
• Connection keys and access tokens on an engineer's computer: if the person leaving is technical, what gets them into the server or lets them pull the code may not be a password at all, but a connection key or a third-party service token held in their own personal environment.

Why ownership should be transferred and the accounts closed before he hands the computer over

Putting the account closures and the ownership transfers ahead of collecting the laptop and the goodbyes is not only about preventing misuse. It is about making sure the company does not lock itself out.

The UK's National Cyber Security Centre (NCSC) is explicit in its 10 Steps to Cyber Security: Identity and access management guidance: an organisation's account management process must include a complete joiners, movers and leavers policy, so that access no longer needed can be revoked immediately when someone leaves or changes role; and the scope of that policy cannot cover only the internal systems the organisation controls. It must also cover the various external online services that staff have registered for or signed into using a company identity, so that access to those can be withdrawn at the same time.

If the order is reversed — the computer collected and wiped, the person already gone — and you discover weeks later that a cloud platform or domain account was tied to his phone for the verification code all along, you now have to go back to a former employee and ask them to receive a code for you. That is awkward, and it depends on whether they feel like helping. While the person is still there and the computer is still open, transfer ownership to a company account in front of them, confirm the company can get in, then disable his personal access on the spot, and collect the computer last. That is the order that actually holds.

One table: the four layers of access to close on the day

Different roles hold different keys. Using the inventory structure set out in Your Engineer Left and the System's Still Running: 12 Things to Get Back First, you can group the accounts to check on the day into these four layers:

Keep the list in normal times, and nothing gets missed on the day

When a company fails to close things cleanly as someone leaves, it is usually not because HR or the owner forgot. It is because nobody actually knows which systems that colleague was given access to during their time there. Each time someone goes, everyone starts guessing from memory which back offices they used, and whatever nobody guesses stays open.

The fix is simple enough: when an employee joins or asks for new access, record each system opened in the same table; on their last day, work down that same table from the top and revoke each line. And if the person handing over is the engineer or outside supplier who looks after the system, then beyond closing their personal account, follow the reminder in Your Engineer Left and the System's Still Running: 12 Things to Get Back First: "the first thing to do once you have it back is change every password and key" — not out of distrust for a former employee, but because you cannot establish where those keys have been stored.

Nerd Technic is a systems software company that came out of custom development, and what we do now is the long-term maintenance of AI systems. As we noted in Your Engineer Left and the System's Still Running: 12 Things to Get Back First, taking over and taking stock of a system after a developer leaves is work we often do in the Helper CTO role: taking over means putting every account, document and record cleanly back under the company's name, so the system is never left hanging because any one person has gone. If you are not sure how many accounts and keys belonging to former staff or old suppliers are still sitting in your system, a system health check is a place to start: Book a system health check