Employee Onboarding & Offboarding

The Day Someone Joins and the Day Someone Leaves Are Two of Your Biggest Security Moments.

Most businesses think hard about getting a new hire set up to do their job. Almost none think as hard about doing it securely, or about making sure access is properly revoked when someone leaves.

An old employee account is a gap that can sit open for years without anyone noticing. A device that never got enrolled in any kind of management system is one that can't be wiped if it's lost. And a former employee whose login still works months after they left isn't a hypothetical risk, it's one of the most common findings in security reviews, regardless of how the person left or on what terms.

These moments don't happen every day, which is exactly why they're easy to handle inconsistently. We make sure they happen the same way, correctly, every time.

Onboarding: Starting Things Off Right

When someone joins your team, we handle the security side of getting them set up:

• Accounts created the right way from day one. Every account from email, your CRM, your scheduling or field service platform, to anything else they need gets created with multi-factor authentication enforced from the start. 
• Devices enrolled before they're handed over. If the new hire is getting a company device, or using a personal device for work, it gets enrolled in your device management platform first. That means screen locks, encryption, and the ability to remotely wipe it later are already in place before it's ever used for business purposes.
• Added to your password manager. Every new employee gets properly set up in it from their first day, rather than being handed a shared login or told to "ask around" for passwords. (And if you aren't using a password manager, there's no time like the present!)
• A quick security briefing. Before they touch any business system, we walk through the basics with them. We touch on what to watch for, how the password manager works, what's expected of them around company devices and data. Fifteen minutes, plain language.

Offboarding: Making Sure Access Leaves With Them

When someone leaves your business, whether it's a retirement, a resignation, or a termination, we make sure their access leaves with them completely. 

• Every account disabled. Email, CRM, scheduling software, file storage, anything tied to their name disabled the same day they leave, not whenever someone gets around to it.
• Device access revoked. If they had a company device, it gets wiped or recovered. If they used a personal device for work, that device's access to business systems gets cut off remotely.
  
• Removed from the password manager. Their access to shared credentials is pulled immediately, and anything they may have had access to that should be rotated, gets rotated.
• The whole process documented. You get a clear record showing exactly what was disabled, when, and by whom. If the departure was anything other than amicable, this documentation matters even more. That way if it's ever questioned later, you have a real answer instead of a guess.