Staff leaving? A simple checklist for removing access to business accounts

When someone leaves your business, you probably collect the keys, the laptop and the company phone. What often gets missed is the digital side: the shared logins, the website admin account, the social media pages and the supplier portals that person could still open next week. This is rarely about bad intent. It is usually about nobody having a list. The National Cyber Security Centre (NCSC) has clear, free guidance on this, and it translates well into a short routine for a business with a handful of staff.

Why old accounts are a real risk

The NCSC's guidance for small organisations says plainly: remove or disable accounts that are no longer needed, because old accounts often keep outdated passwords and weaker security settings. That is the whole problem in one sentence. A former employee, a freelancer who built your site two years ago, or a supplier who needed a one-off login can all leave behind an account that nobody is watching. If that account is ever compromised, for example because the person reused the password elsewhere, an attacker gets in through a door you forgot existed.

The NCSC also advises reviewing access to your important accounts every few months and removing anyone who no longer needs it. That is a simple diary entry, not a project.

Which accounts matter most

You do not need to audit every login in the business on day one. The NCSC suggests prioritising accounts that hold customer or staff information, or that would seriously disrupt the business if they were compromised. Its examples include:

• banking and finance
• HR and payroll
• social media
• online storage
• your company website and domain hosting, if they are separate
• point-of-sale software

For website, banking, HR, payroll, point-of-sale and payment systems, the NCSC says to follow each provider's own guidance on removing users, because the steps differ from one service to the next.

Build a simple leavers routine

The NCSC's 10 Steps guidance on identity and access management says your account management process should include a "joiners, movers and leavers" policy, so access can be revoked when it is no longer needed, or changed when someone moves roles. Temporary accounts should be removed or suspended when they are no longer required. For third parties, make sure you can revoke their access when necessary.

For a small firm, that can be a one-page checklist kept somewhere sensible:

• Before the last day: list every system the person uses. Ask them, and check the list of accounts you hold.
• On the last day: disable their email and main work account, and remove them from banking, payroll, website, social media and point-of-sale systems.
• Straight after: change any password they knew that is still shared, and check that recovery emails and phone numbers on important accounts do not point to a personal address of theirs.
• Within a week: confirm the account list is up to date and note the date it was checked.

The same routine applies to contractors, agencies and suppliers. There is often no formal moment when a freelancer "leaves", so tie the removal of their access to the end of the project or contract instead.

Shared logins: the hard part

Shared passwords are what make leavers difficult. If five people use one login to your social media page, you have to change it for all five whenever one person goes, and you cannot tell who did what. The NCSC says it does not recommend sharing passwords between individuals. Its identity guidance points the same way: you should be able to associate every action in a system with the person or account that performed it.

The practical answer is individual accounts wherever the service allows them. Most business tools, including website platforms, accounting software, email and many social media management tools, let you add users with their own sign-ins. Then removing one person is a single click and nothing else changes.

Where sharing cannot yet be avoided, the NCSC says enterprise password managers can help reduce the risks, for example by logging who accessed a shared password and when, and by making passwords easier to update. It suggests choosing a product that lets users see the difference between shared and individual passwords.

Password managers, passkeys and two-step verification

The NCSC's buyers' guide to password managers says they make it easier for staff to use unique passwords that are harder to guess, and that while they are not perfect, the benefits outweigh the risks. It also warns that if people do not find the tool easy and useful, they will not use it, so pick something your team will actually open. It advises multi-factor support on all cloud-sync password managers, and that administrators should not be able to see or use individual passwords, though they may trigger resets.

Where a service offers passkeys, the NCSC calls them a simpler and more secure way of signing in than passwords or two-step verification, and says you "can't be tricked into sharing a passkey with a criminal". It recommends enabling them on business-critical accounts as a priority. Where passkeys are not available, use a strong, unique password and turn on two-step verification (2SV). The NCSC's guidance says any 2SV is better than none: text message codes are not the most secure type, but still offer a huge advantage over having nothing, and authenticator apps are a stronger alternative. If you use 2SV, keep the backup codes somewhere safe, because they are what you will need if a phone is lost or a person has left with the device that approved the logins.

That last point is worth thinking about before it happens. If the second step for your bank or your website host goes to one employee's personal phone, then their leaving becomes a lockout problem as well as a security one. Move those to a business-owned method, or to the owner's own device, before it matters.

Do not use the admin account for daily work

The NCSC also says not to use the default administrator account on a computer for everyday tasks. If attackers gain control of it, they could take over the device and your accounts. It recommends a standard user account for daily work, with administrator access reserved for when it is needed. The 10 Steps guidance makes the same point for business systems: admins should have separate user accounts for day-to-day business, and privileged access should be revoked when no longer required.

What to do this week

• Write down your ten most important business accounts and who can open each one.
• Remove anyone who no longer works for you or no longer needs access, including old freelancers and agencies.
• Replace shared logins with individual ones where the service allows it, and change any shared password a leaver knew.
• Turn on passkeys or 2SV for those ten accounts, and store backup codes safely.
• Check that recovery emails and phone numbers belong to the business, not to one person.
• Put a review date in the diary for three months' time.

None of this needs specialist software. If your website, online ordering or other systems have grown over the years and nobody is sure who can sign in to what, that is a good moment for a tidy-up. Our cloud and security team can help you set up individual accounts and sensible access, but the checklist above is something you can start with today.