When an employee leaves your business, it's crucial to promptly review your IT security to ensure they no longer have access to your systems and data. This isn't just about disabling their login; it's about protecting your business from potential data breaches, operational disruption, or compliance issues that could arise if former staff retain access to sensitive information.
Why this matters for UK SMEs
For small and medium-sized enterprises (SMEs) in the UK, the risks of not reviewing IT security after staff departures can be significant. Ex-employees with lingering access could inadvertently or deliberately cause data loss, introduce malware, or expose customer information. This can lead to downtime, damage to your reputation, loss of customer trust, and even regulatory penalties under UK GDPR or the Data Protection Act 2018. Cyber Essentials certification, often required for government contracts or supply chains, also emphasises strict access controls and account management.
A typical scenario
Consider a UK SME with around 50 employees. When a sales manager leaves, their user accounts and device access are not immediately revoked. A few weeks later, the business notices unusual activity on their CRM system, including data exports that weren't authorised. An IT partner conducting a security review discovers the ex-employee's credentials are still active. By acting quickly to disable accounts, enforce multi-factor authentication (MFA), and review access logs, the business limits the damage and strengthens its overall security posture.
Practical checklist: What to do when staff leave
- Revoke access immediately: Disable user accounts, email, VPN, and cloud services on or before the employee's last working day.
- Collect and secure devices: Retrieve laptops, mobile phones, and any company-owned equipment to prevent unauthorised use.
- Review access permissions: Check shared folders, cloud storage, and third-party apps for residual permissions linked to the departed employee.
- Change shared passwords: Update passwords for any shared accounts or systems the employee had access to.
- Check audit logs: Review recent login and activity logs for unusual behaviour around the time of departure.
- Enforce MFA: Ensure multi-factor authentication is enabled on all critical systems to reduce risk from compromised credentials.
- Update your IT provider: Inform your managed IT service or vCIO to coordinate and document the offboarding process securely.
- Review policies regularly: Have clear offboarding procedures documented and reviewed at least annually to ensure compliance and consistency.
Questions to ask your IT provider
- How quickly can you deactivate user accounts and revoke access when staff leave?
- Do you provide audit logs and reports to verify offboarding actions?
- Can you assist with enforcing multi-factor authentication and password policies?
- What processes do you recommend for device retrieval and data wiping?
- How do you help maintain compliance with UK data protection regulations during staff changes?
Regularly reviewing IT security after staff departures is a vital part of managing your business's cyber risk and maintaining compliance. If you don't have a clear offboarding process or are unsure about your current approach, it's sensible to speak with a trusted managed IT provider or IT consultant. They can help you implement practical controls, tailor policies to your business needs, and ensure your security keeps pace with your growth.