Joiners, Movers and Leavers: Managing Staff Access
Access problems start when people join, change roles or leave. A simple checklist for small businesses to give the right access at the start and remove it at the end.
In small businesses, access usually grows by accident: someone needs a tool, gets added, and keeps access forever. The three moments to manage are when people join, when they change roles, and when they leave.
Joiners
- Create individual accounts, never shared ones. See shared accounts.
- Give only the access the role needs. See least privilege.
- Set up two-step verification on day one.
- Run a short security briefing. See security onboarding.
Movers
- Add new access for the new role.
- Remove access the old role needed but the new one does not.
Leavers
- Disable accounts on the last day, or immediately for difficult departures.
- Remove from shared drives, groups, social pages and supplier portals.
- Collect devices and remove work data from personal devices. See bring your own device rules.
- Change shared passwords they knew, and transfer ownership of files and accounts.
- Check email forwarding and auto-replies.
For individuals leaving a job, see accounts when you leave a job. For forgotten access, see former staff access.
For more, see protecting small businesses from digital threats.
Frequently asked questions
What is the most common access mistake?
Forgetting to remove access when someone leaves, especially for tools outside the main email system.
Who should own this process?
One named person, often the manager or office lead, working with whoever manages IT.
What about contractors?
Treat them the same, with end dates on their access from the start.
Sources
- 10 Steps to Cyber Security, UK National Cyber Security Centre
- Small organisations guide to cyber security, UK National Cyber Security Centre
- Cybersecurity for Small Business, US Federal Trade Commission
