The Joiners and Leavers Checklist

A former employee or contractor who still has access months after leaving is one of the most ordinary ways companies get breached. It's also one of the easiest to stop.

It rarely happens because nobody cares. It happens because nobody has a list: of every system someone could get into, of who removes what, and of which passwords they knew.

This kit gives you those lists, for every time someone joins, moves or leaves.

What's in it

• Joiners: what to do before day one, on day one and in the first week. That covers company-owned accounts, the right access and no more, multi-factor login, and who to call when something looks wrong.
• Movers: the forgotten one. Add what the new role needs and remove what the old one did, on the day they move. Then a 30-minute quarterly access review to catch the drift.
• Leavers: what to do when they give notice, at the end of their last day and in the days after, including changing every shared password they knew. There's also a short version for when it's sudden or not amicable.
• The system list and the handover: the one list that makes the rest reliable, the systems that usually get missed, and a handover for what only they know.

Who it's for

Owners, managers, HR and IT in growing companies, especially where joiners and leavers are handled by whoever happens to be around.

It builds on The Security Questions Every Executive Should Be Able to Answer and Every Organization Has a Sarah.

It's a practical checklist, not legal or HR advice.

It's a 4-page PDF, made to print and fill in for each person.