Employee onboarding and offboarding checklist.

Before the first day

• Offer letter and employment paperwork signed.
• Employee record created in the HR system.
• Background check completed, if your policy requires one.
• Laptop ordered, set up, encrypted and enrolled in device management.
• Accounts created through your identity provider, with multi-factor authentication required.
• Manager has a plan for the first week.

First day

• Laptop and logins handed over and tested.
• Password manager set up and the right shared vaults granted.
• Access to the specific systems the role needs, and no more.
• Introduction to the team and the main points of contact.

First week

• Company policies read and accepted.
• Security awareness training completed.
• Payroll and benefits enrollment finished.
• Role-specific tools and training underway.

When someone leaves

Offboarding matters more than onboarding for security, and it is more often rushed.

• Set the last working day and tell IT and finance in advance.
• On that day, disable the account in the identity provider, which should cut off connected systems.
• Remove access to anything not connected to single sign-on.
• Change the shared passwords the person could see.
• Transfer ownership of their files, email and any accounts they administered.
• Collect the laptop and other equipment, then wipe it.
• Process final pay and benefits.
• Update the HR system with the departure date.

Make it repeatable

• Keep the checklist in your HR system or project tool, not in someone's head.
• Assign each task to a role, with a deadline relative to the start or end date.
• Keep a list of every system people can have access to, so offboarding has something to check against.

Why auditors care

In a SOC 2 audit, the auditor picks hires and departures from the period and asks for proof that each step happened on time. A checklist that is followed every time is the evidence. See what you have to prove during the audit period.