You know a former employee has lost access to client data when every account, shared permission, device, and physical credential tied to the role has been checked, changes are confirmed in the relevant systems, and unresolved exceptions are closed or clearly contained. A disabled email account is not proof; keep dated records showing who verified each access path.
Which systems could still expose client data?
Start with the person's actual work, not a generic list of applications. Include email, cloud storage, collaboration spaces, business software, remote access, mobile devices, password managers, and client portals.
Look for access that sits outside the main identity account: delegated mailboxes, guest accounts, direct file shares, administrator roles, and memberships inherited through groups. Ask system owners and the employee's manager to identify client environments or vendor portals used for the role.
Physical access belongs in the review when the person could reach paper records, network equipment, or work areas. Check badge and door permissions with whoever administers the building system, including a property manager where that responsibility is external.
A complete inventory follows the person's work, not just the organization chart.
How do we confirm digital access has been removed?
Disable the identity in each system on the inventory, then check the system's administrative records to confirm the change. Review direct and inherited permissions, groups, delegated access, and roles; a central account change may not remove a separately assigned permission.
Where available, revoke active sessions and trusted devices. Review authentication methods and account recovery options as well, so old phone numbers, personal email addresses, or enrolled devices cannot provide a route back in.
Verify with an authorized administrator account and the platform's audit or access records. Do not attempt to sign in as the former employee or use their credentials. Record the system, action, time, and person who checked it.
Verify every system in the inventory; an email shutdown alone does not establish that client-data access ended.
Administrative evidence turns an assumption into a checkable result.
What access paths are commonly overlooked?
Shared folders and collaboration workspaces can retain direct links, guest access, or group permissions after a project ends. Review who can reach the data, remove access that is no longer needed, and preserve records in line with the organization's retention and legal requirements.
Remote access tools may have their own accounts or device lists. Check VPN or remote desktop permissions, endpoint-management records, browser sessions, and credentials stored on company devices. For a returned device, document custody and follow the approved process for securing or wiping it.
Also check client-managed systems, vendor portals, password managers, and building credentials. Some access must be removed by a client or property administrator; assign someone to obtain confirmation rather than marking that item complete based on a request alone.
For each item, distinguish between access that has been removed, access that remains for a documented business reason, and access that cannot yet be verified. An exception needs a named owner and a next action, not just a note that someone was contacted. If a third party controls the system, request confirmation through an approved channel and retain the response.
Check whether the former employee created or held any recovery methods, integration credentials, API keys, or shared secrets used by a team. Rotate shared credentials when their exposure cannot be ruled out, and update the protected record so current staff can continue working. Avoid copying secrets into the offboarding checklist.
The final pass should cover the systems and places where the person actually worked.
What records should we retain after offboarding?
Keep a dated record listing systems reviewed, changes made, evidence checked, exceptions, and the person responsible for verification. Store administrative confirmations or change records securely. Do not include passwords, secret tokens, or unnecessary copies of client information.
Separate completed work from open dependencies. If a device is missing or an outside administrator has not confirmed removal, identify the risk, assign an owner, and set a follow-up. Do not describe offboarding as fully verified while a material access path remains unresolved.
A practical record can follow a short sequence:
- Identify the employee's systems, client environments, devices, and physical credentials.
- Assign an owner and authorized administrator for each access path.
- Remove access, revoke sessions where available, and secure returned equipment.
- Confirm each change in the system's administrative record or obtain third-party confirmation.
- Track exceptions to resolution and record the final verifier and date.
This sequence makes omissions visible and gives a reviewer a clear way to distinguish verified work from requests still in progress. Keep the evidence proportionate: enough to show what was checked and when, without retaining sensitive client data that is not needed for the audit trail.
Therese, a commercial real estate professional, described GDS support this way: "Brian clearly explains what is happening and shows you ways to help prevent the issue from happening again. He is great to work with." Clear explanation and prevention matter here too: document what changed and correct any process gap that allowed access to be missed.
A useful record gives leadership a clear answer and a trail to review.
How can Atlanta businesses make offboarding repeatable?
Build the checklist around roles, systems, and accountable owners. Include client-data access, devices, authentication, remote work, shared resources, and physical credentials. Define who starts the process, who verifies each system, and how exceptions reach a decision-maker.
Atlanta workplaces can involve separate suites, shared buildings, and property-managed access controls. Confirm who controls each badge or door system and include that contact in the offboarding procedure. Do not assume a company account change also updates a landlord's or building operator's system.
Review the procedure when roles, applications, or building arrangements change. If the same permission is repeatedly missed, fix the handoff or system ownership rather than relying on someone to remember an extra step. GDS Technology supports managed IT services and cybersecurity services that can help organizations review access processes and technology controls.
For organizations with formal obligations, align the checklist with their own policies and legal advice. GDS offers IT compliance services; engaging a provider does not transfer the organization's responsibilities or establish compliance by itself.
Repeatable ownership keeps departures from becoming preventable business interruptions.
Frequently Asked Questions
Is disabling an employee's email enough to stop access to client data?
No. Disabling email closes only one route. A former employee may still have access through cloud storage, client portals, remote access, mobile devices, shared workspaces, or physical credentials. Build an inventory from the person's actual role, remove access system by system, and keep dated administrative evidence of each check.
How quickly should we remove a former employee's access?
Set the timing in your offboarding procedure and coordinate it with the employment decision and business handoff. The appropriate sequence depends on operational needs, risk, and any legal direction. Name the decision-maker, trigger, and evidence of completion in advance; do not treat an assumed universal deadline as a substitute for a documented process.
What if a former employee still appears to have access?
Have an authorized administrator restrict the access path and preserve relevant system records. Determine whether it is active, inherited, or attached to a separate account, then notify the internal owner. If client information may have been accessed, follow your incident-response process and consult qualified counsel about any notification obligations.
How can we prove offboarding was completed?
Keep a dated checklist naming every system reviewed, the action taken, the verifier, and any unresolved exception. Retain administrative confirmations or change records, not passwords or unnecessary copies of client data. An email-disable record alone cannot show that other accounts, shared permissions, devices, or physical credentials were checked.
