When an employee joins, changes roles or leaves: an access handoff checklist

Treat a personnel change as a workflow change

An employee change can affect more than a mailbox. The person may use a project workspace, remote access, physical keys, a shared device and external services. A small company's handoff should help the responsible people identify those connections without collecting passwords or broadcasting account details in an ordinary spreadsheet.

FAR 52.204-21 addresses access by authorized users, permitted functions, user identification and authentication, among other safeguarding requirements. It also addresses physical access, visitor handling and media protection. This checklist is an editorial way to coordinate relevant questions. It does not prescribe a universal account configuration or replace the complete assessment objectives for the actual environment.

Before using a checklist, decide who approves access, who changes it and who verifies the result. Those may be different people or separate roles held by one person. Use role names in a nonsensitive planning record and retain detailed implementation records in the approved internal system. A handoff is easier to review when its boundaries are explicit.

For a new person, begin with authorized work

Describe the work the person is authorized to perform, then identify the systems and functions needed for it. A convenient copy of another employee's access can carry permissions that the new person does not need. Ask the responsible approver to confirm the intended access and the implementation owner to explain how it will be established.

Consider physical access and devices as well as application accounts. Who supplies the device? Which workspace is approved? Does a service provider perform part of the setup? A provider's involvement should be visible in the handoff so the company knows what it must still approve, supply or check. Do not assume a broad service contract means every new person was enrolled correctly.

Fictional Juniper Parts hires a scheduling coordinator. Its manager authorizes the scheduling functions, the IT provider implements the approved access, and a designated reviewer checks the relevant configuration and the person's ability to use the intended workflow. The example is fictional; it makes no claim about an actual customer, security outcome or required completion time.

For a role change, review the access being left behind

A promotion or temporary assignment can add permissions without removing older ones. Ask what the person will stop doing as well as what they will start doing. Record the approval decision and any exceptional access that must remain, together with the person responsible for revisiting it. An unexplained exception should not become a permanent assumption.

Review shared resources and external services through the people who administer them. The access owner should understand what the employee can actually reach, not only the title in the personnel record. Where a shared credential or device creates a question, investigate the applicable requirements and the actual arrangement instead of declaring the checklist complete.

Use the same source of truth for both the operational handoff and its follow-up. A planning log can point to an internal access-change record. It should not reproduce personal information, authentication details, controlled work files or screenshots of the full environment. A short reference can preserve accountability without turning the planning worksheet into a sensitive repository.

For a departure, verify the affected paths

A departure handoff should identify the relevant systems, physical access devices, equipment and work responsibilities. The responsible owner should decide and implement the appropriate changes under the company's procedures and applicable obligations. This article does not invent a universal revocation deadline; timing needs to reflect the actual situation and requirements.

Check the handoff rather than relying on the initial request alone. For example, confirm that the service provider received the authorized instruction and that the company can locate the appropriate completion record. Address company devices and media through the relevant handling and disposal process. Do not equate deleting a folder with verified sanitization.

Close the planning action only when the intended reviewer understands what was changed and what remains unresolved. If a gap is found, assign a corrective action and follow-up check. This record supports internal organization; it does not declare a safeguard MET or confer Level 1 status. Use the complete official criteria and actual assessment scope when performing the self-assessment.

Fictional working template