When an employee leaves your business, it's essential to ensure they no longer have access to your phone system. This means removing their ability to make or receive calls, access voicemail, or use any connected features. If not managed properly, former staff could potentially misuse your phone system, leading to security risks, unauthorised calls, or data breaches.
Why this matters for UK SMEs
Allowing leavers continued access to your phone system can disrupt your operations and damage your reputation. For example, an ex-employee might access sensitive customer information stored in voicemail or use the system to impersonate your business, harming customer trust. From a compliance perspective, UK data protection laws such as the Data Protection Act 2018 and UK GDPR require you to control access to personal data, which includes phone records and messages.
Additionally, unauthorised use can lead to unexpected charges or service interruptions. Ensuring timely deactivation of accounts helps maintain business continuity, protects your data, and supports audit readiness, especially if you're working towards Cyber Essentials or ISO 27001 certification.
A typical scenario
Consider a UK SME with 50 staff using a cloud-based VoIP system. When a sales executive leaves, their phone extension and voicemail remain active because the IT team wasn't informed promptly. The ex-employee uses the system to make international calls, generating high costs, and accesses confidential client voicemails, risking data breaches. A managed IT provider would prevent this by integrating leaver processes with the phone system, ensuring immediate suspension of access once HR confirms the departure.
Practical checklist to secure your phone system for leavers
- Establish a clear offboarding process: Ensure HR notifies IT promptly when someone leaves.
- Ask your IT provider: How quickly can they disable phone accounts or extensions after a leaver's departure?
- Check access controls: Confirm that user accounts are linked to individual employees and can be deactivated without affecting others.
- Review your phone system's admin portal: Regularly audit active users and extensions to spot any that should be removed.
- Implement multi-factor authentication (MFA): For admin access to your phone system, to prevent unauthorised changes.
- Ensure voicemail and call recordings are archived securely: This supports compliance and audit requirements.
- Include phone system access in your supplier questionnaires: When selecting or reviewing providers, check their security and offboarding procedures.
- Document your policies: Have clear written rules on who manages phone system access and how leavers are handled.
Common pitfalls to avoid
One frequent issue is relying solely on manual processes, which can lead to delays or oversights. Another is sharing generic logins rather than individual accounts, making it impossible to revoke access for one person without affecting others. Avoid keeping voicemail passwords unchanged after staff leave, as this can allow unauthorised access.
Regular training for HR and IT teams on the importance of timely deactivation and secure handling of phone system credentials is also vital.
If you're unsure whether your current setup adequately protects your phone system, speak with a trusted managed IT provider or IT advisor. They can help review your processes, recommend improvements, and ensure your phone system access aligns with your broader cybersecurity and compliance goals.