Philippines staffing guide
A Remote Access Offboarding Checklist That Closes Gaps
Removing the main account is not enough. Check sessions, tokens, shared drives, devices, and the accounts nobody remembers.
The short answer
Offboarding is a verification process. Disable the main account, then hunt the sessions, tokens, devices, and shared links.
Start before the last day
Prepare the offboarding before the final shift. List every system the person can access, including the ones they use occasionally. Include shared mailboxes, file drives, project tools, password vaults, payment portals, and any client-specific accounts.
Name the owner who will verify each removal. If the person is leaving abruptly, use the same list under the incident path. A calm final week is easier than an emergency, but the checklist should work for both.
Disable, revoke, and rotate
Disable the primary identity first. Then revoke active sessions, refresh tokens, API keys, and connected apps. Rotate shared credentials the person could see.
Check devices for local copies and remote management. Remove the person from groups, distribution lists, and approval chains. If they were a backup owner, assign a new one.
Do not stop at the admin console's disable button. Many systems keep a separate session or token alive after the main account is closed.
Recover the work, not just the access
Check the queue for items assigned to the person. Reassign them with a short note about the state and the next action. Review drafts, scheduled messages, and pending approvals.
A departing worker may have promised a customer something that no one else knows about. Read the sent messages for the last week where the role involves customer commitments. Recover the files that belong to the company and confirm the return of devices.
Verify from the other side
Ask a second person to test that the access is actually gone. Try the account, the shared link, and the device enrollment. Check the audit log for activity after the disable time.
Record who verified each system and when. If a removal fails, keep the task open and escalate.
A checklist with unchecked boxes is not evidence. The verification step is what turns the list into a control.
Review the departure for patterns
After the offboarding, review what access existed, how long it took to remove, and whether any account was missed. If the same system is missed repeatedly, fix the inventory or the integration.
If the person had more access than the role required, revisit the least-privilege design. The next departure will be easier if this one produced a better map.
Questions to copy for the sales call
- "Which systems and shared credentials can this person access?"
- "Who owns the removal and the verification for each one?"
- "What work must be reassigned before the last day?"
- "How will we prove the access is gone?"
Sources
- NIST Cybersecurity Framework 2.0: Governance, identity, and risk outcomes. Checked October 22, 2026.
- CISA Cybersecurity Performance Goals: Practical access, logging, and recovery goals. Checked October 22, 2026.
- National Privacy Commission, Philippines: Philippine data privacy regulator. Checked October 22, 2026.
Common questions
Is disabling the email account enough?
No. Check sessions, tokens, shared drives, devices, password vaults, and any client-specific tools.
How quickly should access be removed?
Immediately for involuntary departures. For planned departures, agree a time on the final day and verify it. Do not wait for the next business day.
Who should verify the removal?
Someone other than the person who performed it, ideally the system or security owner. Record the verification time.