Employee Offboarding and Cyber Risk: A Texas Small Business Checklist

When a bookkeeper, office manager, project coordinator, or outside contractor leaves, the usual checklist covers keys, a laptop, and the final handoff. But the former worker may also have a cloud email login, a payroll account, a shared password to a vendor portal, access to customer files, and an authenticator on a personal phone. Returning a keycard does not close those doors.

For a small Texas business, this is not just an IT issue. A stale account can complicate an investigation after fraudulent payments, exposed customer records, ransomware, or an outage. The problem is not always misconduct by the person who left: an old password may be stolen later, a forwarding rule may persist, or an attacker may impersonate a departed manager. A clean offboarding process protects the business and helps avoid unfairly blaming a former employee for activity under an account that should have been disabled.

The NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide recommends identifying the systems a business relies on, assigning responsibility, restricting access, planning for incidents, and assessing whether cyber insurance fits. You can turn that broad guidance into a short departure routine without building a large IT department.

Map access before someone leaves

Start with a simple list of the systems that matter. Record each system's owner, who can log in, whether multifactor authentication (MFA) is enabled, and whether it holds sensitive information or keeps operations running. NIST's guide includes a sample inventory with many of those fields. Keep the list in a restricted place and revisit it when your business adds software or a new vendor.

For a Friendswood contractor, the list might include bid software, a shared project drive, a supplier portal, company email, fuel cards, and banking permissions. For a New Braunfels medical practice, it may include scheduling, billing, electronic records, a patient messaging platform, and the account used by an outside IT provider. A Houston-area restaurant may need to check point-of-sale administration, delivery-platform accounts, payroll, and the email inbox that receives password resets. Not every departing worker has access to every system; the point is to know what this person could reach.

Do not overlook integrations and delegated access. An employee may have permission through a group in a cloud workspace rather than a direct account in a particular app. A contractor might be invited as a guest to a shared folder. A personal phone may receive login prompts even after a password changes. Ask your IT provider or software vendor how to see active users, sessions, recovery methods, connected apps, and audit logs for your actual tools.

A departure-day sequence that someone owns

Give the owner, HR contact, or manager one accountable name for initiating offboarding and another for confirming completion. Schedule routine departures for the agreed end of access; coordinate an immediate removal with your IT support when circumstances require it. This is a security workflow, not a suggestion about employment-law timing or preservation duties.

1. Confirm the effective time and the access list. Have the manager identify the worker's devices, email address, app accounts, payment authority, remote access, vendor logins, and physical credentials. Include contractor and temporary-staff access. Note who will take over open work.
2. Disable the individual identity. Ask the administrator to disable or remove the person's central work account and any separate app accounts. Revoke active sessions, remote access, recovery options, app tokens, and MFA methods where the systems allow it. Removing someone from a team chat is not the same as ending their access to the shared drive or accounting platform.
3. Secure shared routes. Inventory shared logins, door codes, recovery emails, API keys, and emergency administrator credentials the person knew or controlled. Rotate or replace what is necessary and move toward individual accounts instead of a permanently shared password. Check that a manager—not the departing worker—retains legitimate administrator and recovery access.
4. Transfer work without leaving a live mailbox. Assign active customer inquiries and projects to a current worker. If business continuity requires retaining email, use a controlled delegation or archive arrangement rather than keeping the old user login active. Review forwarding rules, inbox delegates, and automatic replies with your IT provider. Handle employee records and mailbox retention according to your legal and operational requirements.
5. Recover and review devices. Collect company-issued computers, phones, cards, storage media, and keys. If work happened on a personal device, ask your IT provider about removing company-managed access or data without assuming the business may wipe the whole personal device. Update the device inventory and document anything still outstanding.
6. Verify completion. The designated reviewer checks actual admin screens or a provider's confirmation: accounts disabled, sessions revoked, shared credentials changed where needed, and access removed from the critical systems list. Record the date, time, person who did the work, and any exception with an owner and deadline.

The FTC's small-business cybersecurity guidance recommends inventorying systems and data, controlling who can log in, limiting sensitive access to people who need it, using MFA, and restricting vendors to the time they need access. Those are useful tests for your checklist; they are not a promise that every incident can be prevented.

The three gaps that survive a password change

Shared access. If five people use one portal login, disabling one person's email account may change nothing inside that portal. Ask the vendor for individual named users and permission levels. Until you have them, track who knows the shared credential and rotate it promptly when someone leaves. Make sure no password-reset link still goes to an old address or personal phone.

Sessions and connected tools. Some services let a user remain signed in on an existing device or through a connected app even after a password is changed. Where supported, revoke sessions and third-party app authorizations, then inspect recent sign-in activity. If your team cannot find these settings, the right next step is a support ticket with the provider, not an assumption that clicking “reset password” solved it.

Authority outside the main network. A former employee's banking approval rights, purchasing card, supplier account, payroll role, or building code may be maintained by a separate administrator. Ask the bank, payment platform, vendor, or property manager what it takes to remove the user. A logistics company should also consider dispatch and freight portals; a professional firm should check client collaboration spaces and e-signature tools.

These gaps matter most when an account can move money, expose regulated or confidential information, or stop a business-critical process. Start there if your list is long. Do not delay removing obvious high-risk access while waiting for a perfect inventory.

Keep MFA and backups in the picture—but know their limits

MFA makes a stolen password less useful, especially on email, financial systems, remote access, and administrator accounts. Each worker should have their own account and approved authentication method where practical. Review who can add a new MFA device or reset a password, because an old recovery email or phone can undermine a carefully rotated password. Phishing-resistant methods may be available for especially sensitive accounts; ask your provider which options its product supports.

Reliable backups and a tested recovery plan matter if an incident destroys or locks files. Keep backup administration separate from ordinary user permissions where feasible, and confirm that an authorized current employee or provider can actually restore a needed system. A backup cannot undo a wire transfer or tell you who viewed a customer file. The FTC describes MFA, access controls, backups, incident response, and business continuity as complementary safeguards, not interchangeable ones.

If your business depends on one hosted system—for example, a retailer's checkout, a clinic's scheduling, or a contractor's project files—write down a fallback for the first day without it. Who calls the vendor? Where are current orders or appointments? Who decides whether to pause transactions? This operational handoff is as important as the technical deactivation.

A hypothetical: the former office manager's account

Suppose a San Antonio-area professional firm parts ways with an office manager. IT disables the company's email login, but a separate bookkeeping application still has an active account and a personal phone remains registered for its recovery prompts. Two weeks later, an unfamiliar login appears and a vendor record is edited. No one yet knows whether the former worker, a third party with stolen credentials, or an unrelated administrator made the change.

The immediate job is not to guess who did it. The firm should stop any pending payment through its normal approval process, ask its IT and bookkeeping providers to preserve account activity and secure access, and call the bank if money moved. It should document what the old account could access, whether personal information was exposed, and when the role was actually disabled. That factual timeline is essential for incident response and for a meaningful insurance discussion.

A separate published vendor bank-change playbook explains the independent callback and approval steps for a suspicious payment instruction. Offboarding addresses a different weakness: the identity and privileges still sitting behind the payment workflow.

Where cyber insurance may help—and where it may not

Do not assume a cyber policy pays simply because an old login was involved. A policy may address some response costs after unauthorized system access or a data breach, and some forms may address data recovery, business interruption, or liability to affected customers. But definitions, exclusions, retentions, waiting periods, sublimits, and notification terms vary. The FTC's cyber-insurance overview for small businesses distinguishes a company's own incident costs from liability claims made by others; use the actual policy wording to see which parts apply.

Bring your agent three concrete scenarios rather than asking only, “Do we have cyber coverage?”

• Old account, exposed client records: If a third party signs in using an account we failed to disable, what forensic, legal, notification, and third-party liability costs might respond? Does the policy distinguish external account takeover from intentional acts by an employee or former worker?
• Old authority, diverted payment: If someone uses an old accounting login to change a payee and our authorized employee sends money, is there any applicable social-engineering or funds-transfer-fraud coverage under cyber or commercial crime? If the attacker directly initiates a transfer instead, does the answer change? What verification and reporting conditions apply?
• Old admin access, interrupted operations: If an account is used to encrypt files or disable a key system, are data restoration and cyber business interruption covered? How do waiting periods, backup conditions, and any dependent-provider wording affect the answer?

If a customer alleges that an error in professional services caused a loss, professional liability or errors-and-omissions coverage may also need review; ordinary general liability or property insurance should not be presumed to cover an electronic-data or payment loss. Ask the agent to compare the policies together and identify overlaps and gaps. Cyber, commercial crime, and professional liability do not become equivalent just because the same event touches all three.

Applications and renewals may ask about MFA, backups, privileged access, prior incidents, and outsourced IT. Answer for the systems you actually use. If MFA is on for email but off for a separate administrator portal, do not describe it as universal. If a vendor manages backups, ask for evidence of what is backed up and whether restores have been tested. An insurer's questions and any conditions vary by carrier and form; accuracy matters more than a box checked from memory. NIST's small-business guide explicitly suggests assessing cyber insurance alongside broader risk planning, not substituting insurance for controls.

If you discover access after the departure

Ask your IT lead or provider to secure the account and preserve available logs, devices, messages, and timestamps. Check whether any sessions, forwarding rules, recovery methods, shared credentials, or vendor accounts remain active. Avoid deleting evidence or making public accusations before the facts are established. If money may have moved, contact the bank's fraud team promptly. Notify your agent or carrier using the policy's reporting process; ask before retaining expensive response vendors if the form has panel or consent provisions.

If personal information may have been accessed, get appropriate legal and incident-response advice on what the facts require. A suspicious login does not by itself prove that data was taken or that any particular notification rule applies. The FTC's data-breach response guide recommends securing operations, preserving evidence, identifying the scope, and consulting counsel about applicable notice obligations. Healthcare and other regulated businesses may have additional requirements, so use specialists familiar with your sector rather than a generic email template.

Make the checklist repeatable

Choose one person who starts the task, one who completes technical removal, and one who verifies the result. Give the checklist to whoever covers when the owner is away. Repeat it for contractors and vendors at the end of their access period, not just employees. Review the access inventory after a new system is added, after a role changes, and at renewal time. A three-column sheet—system, person with access, confirmation of removal—is a practical starting point.

For help reviewing how your business's cyber, crime, and other policies fit these exposures, call BIG – Brock Insurance Group at (281) 482-4244 or request a quote. BIG can help Texas businesses compare suitable options and value through its independent carrier network, with personal guidance tied to how their people and systems actually work.