Managing HR and recruiting accounts

Account checklist for onboarding and offboarding employees

At hire: a personal login, only the access the job needs, signed agreements. At exit: disable logins, change shared passwords, collect property, log each step.

Updated October 16, 2026

An account checklist for onboarding and offboarding lists what you set up when someone starts and what you shut off when they leave. Next to each item, the person who did it writes the date. The three lists below are written for HR and recruiting teams, with the reason and the source for each item. The terms themselves are defined in What do onboarding and offboarding mean for account access?

The sources are two US references. NIST SP 800-53 Rev. 5 is a catalog of security controls, required for federal systems and used by other organizations on a voluntary basis. The FTC’s guide Protecting Personal Information sets out basic security steps for any business that keeps personal data.

Who keeps the checklist

HR starts the checklist, because HR learns first that someone is joining, moving or leaving. NIST control AC-2 l asks you to align account management with personnel termination and transfer processes. AC-2 h asks that account managers be told within a set period when someone is terminated or transferred.

The work itself is spread out. IT runs email and the company directory, and each tool has its own admin. So HR opens the checklist, each admin does their step and writes the date, and HR collects it when every line is filled in. Some tools are run by HR itself, such as job boards, the applicant tracking system and payroll. For those, HR does both parts.

When someone starts

List the tools and accounts the job needs

Without a list of who may use which account, there’s nothing to check against at exit.

Source

AC-2 d asks you to specify the authorized users of each account and their access.
Create the person’s own login, with an approval

The approval shows later who allowed the access and who received it.

Source

AC-2 e asks for approval of account requests. IA-2 asks you to identify each user uniquely.
Give only the access the job needs

Rights a person doesn’t use still let a mistake or misuse reach more data.

Source

AC-6, least privilege.
Add the person to the user list of each shared account

Some accounts can’t be split, such as a single company login on a job board. Decide how you will know who used it, since the tool’s own history shows only the account name.

Source

The IA-2 discussion notes that you may need to identify individuals in group accounts.
Don’t send two-step codes only to one person’s phone

If the person who receives the codes leaves, the people who stay can’t sign in. See Sharing two-step verification across a team.
Have the person sign access agreements

This includes a nondisclosure agreement and an acceptable use agreement.

Source

PS-6 c asks people to sign before they get access.
Write down start and end dates for temps and seasonal staff

If no one has the end date, no one knows when to shut the login off.

Source

The AC-2 discussion names temporary accounts that are no longer needed as a reason to disable them. PS-7 d asks you to require outside firms, such as the staffing agency that placed the temp, to tell you when their people leave or move.

For item 4, Comparing ways for several people to use one shared account covers the ways to know who used a shared login.

When someone changes roles

Review the access from the old role and remove what’s no longer needed

If each move only adds rights, one person ends up with far more than any job needs.

Source

PS-5 a and c ask you to confirm ongoing need and change access to fit the new role.
Take the person off the old team’s shared accounts

If they knew the password, change it.

Source

AC-2 k.
Finish within a set period after the transfer

Source

PS-5 b asks you to start transfer actions within a period you define.

When someone leaves

Send the list of the person’s accounts to each account owner as soon as the end date is known

Include outside tools such as job boards and payroll portals. Internal steps don’t reach them on their own.

Source

AC-2 h and AC-2 l.
For a termination for cause, consider disabling access before the person is told

Source

The PS-4 discussion calls timely action essential in that case.
Disable the person’s logins and revoke their sign-in methods

This includes remote access and any hardware sign-in device.

Source

PS-4 a and b.
Disable first, delete later

You still need the files and records the person controlled. Before deleting a user in any tool, check what it erases with the account.

Source

PS-4 e.
Check admin rights separately

If the person owned an account or held admin rights, hand those to someone who is staying. Managing privileged accounts covers these accounts.
Change the passwords of shared accounts they knew

Take them off each user list, change the password, and give the new one to those who stay.

Source

AC-2 k.
Move two-step codes off their phone or email

Otherwise the people who stay can’t sign in, and the codes keep reaching the person who left.
Collect company property

Collect laptops, phones, badges, keys and hardware sign-in devices.

Source

PS-4 d. The FTC guide says to “terminate their passwords, and collect keys and identification cards as part of the check-out routine.”
Hold an exit interview

Remind the person of the nondisclosure agreement they signed.

Source

PS-4 c and its discussion.
Write down the date and the person for every item, and keep the checklist

Without a record, you can’t show later that access was shut off.

Item 6 grows with the number of people and accounts. The limits of changing shared passwords every time someone leaves explains why.

How fast access should be turned off

NIST doesn’t give a number of days. PS-4 a says to disable access within an “organization-defined time period,” and AC-2 h does the same for telling account managers. The choice is yours, and it belongs in writing in the exit steps.

When you set it, put shared password changes on the same deadline. A disabled personal login does nothing about a shared password the person still knows. Apply the same deadline when a temp’s assignment or a contract ends, not only when an employee leaves.

Frequently asked questions

How soon should a former employee's access be turned off?

NIST SP 800-53 PS-4 leaves the period to you and gives no number of days. Pick a deadline you can meet and write it into the exit steps. For a termination for cause, PS-4 suggests you may disable access before the person is told.

Who owns the offboarding checklist, HR or IT?

HR starts it, because HR knows the dates first. Each account owner does their step and writes down the date. NIST SP 800-53 AC-2 l asks you to align account management with HR's termination and transfer steps.

Why sign agreements at the start and not only at exit?

NIST SP 800-53 PS-6 asks people to sign access agreements, such as a nondisclosure agreement, before they get access. At exit, the interview reminds them of what they signed.

Do we change shared passwords every time someone leaves?

If the person knew the password, yes. NIST SP 800-53 AC-2 k asks for a process to change it when someone leaves the group. Personal accounts, or a tool that signs people in without showing the password, remove that step.

How Junify handles this

Doing this by hand: You set up job board and HR system access person by person, add and remove it whenever seasonal staff come and go or an RPO partner starts or finishes, and keep track of who opened applicant data.
With Junify: Junify handles the shared-account items on this checklist. An admin adds the person and assigns the shared logins they need, and removes those assignments when they leave. Junify records who used each account. People never receive the shared passwords, so there is no password to change and send out again.

Try the demo Book a 30-minute demo