Someone left the company. Did we revoke all their access?

Disabling the main company login is a starting point. It only covers access that actually depends on that login. Local accounts, active sessions and credentials copied into scripts can need separate action.

CIS Control 6 covers managing and revoking access for user, administrator and service accounts. Apply that thinking to the systems the departing person could reach, including access granted outside your usual onboarding process.

Establish the effective departure time

Coordinate the timing with the responsible manager and HR. Identify the accounts and systems in scope before the access cutoff where possible. For an urgent departure, follow the agreed escalation process and record any follow-up work.

Avoid making the departing person the only source of information. Compare the systems register with identity-provider records and relevant system-owner records.

Check the access that survives the main account

A useful offboarding review includes:

Local accounts in SaaS tools and vendor portals that bypass single sign-on.
Privileged cloud roles, database accounts and SSH keys.
Active sessions, personal access tokens and application passwords.
Shared credentials the person knew, including recovery codes where relevant.
Physical access and company devices, with a separate record of their return or other agreed disposition.

Revoke or rotate credentials according to their exposure. Removing a user from a password manager does not erase secrets they previously copied. Test the revocation using administrative records or an approved verification method; do not ask for their password.

Transfer ownership without preserving personal access

Scheduled jobs and business records may depend on the person’s account. Assign a new owner and migrate service dependencies to an appropriate service identity. Keep the work visible until that migration is complete.

Handle mailbox contents and retained records through your approved retention and access process. A need to retain business information does not require leaving the former employee’s login active.

Record completion and exceptions

For each relevant system, record the action, effective time and person who confirmed it. Give unresolved items an owner and deadline. A single checked box labelled “offboarded” is difficult to investigate if a forgotten account appears later.

Yrso’s existing checks and actions can support this evidence trail. Dedicated onboarding and offboarding workflows are on the roadmap; access reviews are in testing with selected clients. Do not assume either replaces immediate revocation when someone leaves.