Send us the RFP Sign up free
Sign up free Send us the RFP
Back to course

P4 Shared Accounts and Offboarding

0% done: 0 of 6 lessons

Lesson 4 of 6 · Simulation

The day someone leaves

Progress is saved on this device only. Keep it across devices with a free LFW account.

Curriculum0 of 6 done

Simulation

Remove a departing editor's access in WordPress

A working copy of the real screen. Use it as you would the real one. Nothing you type leaves this page.

This exercise runs in your browser and needs JavaScript. The lesson text above covers the same steps.

Not done yet.

A checklist you run the same day anyone with access leaves or changes jobs, so no account stays tied to a person who no longer works there.

Notes

Step 1 of 6

Start here

The riskiest day for an institution's accounts is the day someone leaves. Their access does not leave with them unless someone removes it. Months later, a former employee can still post to the town's social media page, the newsletter still sends test emails to their personal address and the registrar's renewal notice goes to an inbox nobody reads.

CISA's Cybersecurity Performance Goals call for a defined and enforced administrative process to offboard staff (goal 3.D). This lesson is that process for the web presence.

Step 2 of 6

Make sure you are told

The checklist only works if the web owner knows someone is leaving. Ask HR or your manager to add one line to the departure process: "Notify the web owner of the last day, at least a week ahead when possible." Include job changes and long leaves.

For a departure that is not friendly, access is removed at the same time the person is told, not after.

Remember: Access ends when the job does.

Step 3 of 6

The checklist

Use your inventory from lesson 1. Filter it for every account the person could reach, then work down this list on their last day.

Their own logins

  1. Disable their account on the website. Before deleting any website user, reassign their pages or posts to another person. WordPress, for example, asks what to do with a deleted user's content.
  2. Remove them from social media pages, the newsletter service, forms, analytics, the hosting and DNS accounts and any vendor portals.
  3. Remove them from the password manager's shared vaults.

Shared secrets they knew

  1. Change the password of every shared login they could see, and update it in the vault.
  2. Reset any shared two-step sign-in set up on their phone, and move it to a method the remaining people can reach.

Things that point to them

  1. Find every account where their address is the login, recovery email or recovery phone, and change it to a role mailbox.
  2. Update form recipients, alert and approval lists, and vendor contact records.
  3. Check the domain registrar's contacts. The registrant and administrative contacts must be current.

Things they hold

  1. Collect laptops, phones and security keys.
  2. Handle their mailbox under your institution's records policy. Mail may need to be kept, and forwarding or an automatic reply may be needed. Ask your clerk.

Close it out

  1. Record the date each step was done, and who did it.
  2. Update the inventory.
Try it A departing editor wrote 37 news posts. What happens to them before the account is deleted?

Show the answer

B. They are attributed to a person who stays. WordPress asks what to do with a deleted user's content. Attribute it to a named person who stays, never to a shared login.

Step 4 of 6

Accounts in their name

Sometimes an account belongs to the person, not the institution: the page was created on their personal profile, or the service was paid on their own card. Before they leave, ask them to transfer it. Most services have a process to change the owner. After they leave, it can take weeks of support tickets, or be impossible.

That is the reason to find these accounts in lesson 1, before anyone is leaving.

Step 5 of 6

Job changes and long leave

A move from one department to another is a partial departure. Remove the access the old job needed, and give what the new job needs. For long leave, suspend access that will not be used, and confirm a backup can cover every account they managed.

Step 6 of 6

Make it kind and routine

Run the checklist for every departure, including retirements and people everyone trusts. It is not an accusation. It protects the person too: nobody can later claim they did something with an account they no longer had.

Sources

Task

Your task at your institution

Quiz

5 questions. Choose one answer for each, then check them. Each answer shows its reason.

1. When should a departing employee's access be removed?
2. In a website, should you delete the departing person's account or disable it?
3. They knew the shared social media password. What do you do?
4. Who tells the web owner that someone is leaving?
5. Someone moves from Parks to the Clerk's office. Does the checklist apply?
Show the answers
  1. B. By the day they leave. CISA's goal 3.D calls for a defined and enforced process to offboard staff. Access ends when the job does.
  2. B. Disable it, or reassign their content before deleting. Deleting a user can delete or orphan their content. Disable or reassign first.
  3. B. Change it the same day, and update the vault. Everyone who knew a shared password still knows it.
  4. B. HR or the supervisor, as a written step in the departure process. If notice depends on memory, it will be missed. Make it a step on the HR checklist.
  5. B. Yes. Remove access the old job needed, and add what the new one needs. A job change is a partial departure. Access follows the job, not the person.