What do onboarding and offboarding mean for account access?
- Term
- Onboarding and offboarding (account access)
- Meaning
- For accounts, onboarding gives a new person their own logins and only the access the job needs. Offboarding shuts those off and changes shared passwords.
Onboarding and offboarding usually mean everything that happens when someone joins or leaves a company, from paperwork and payroll setup to training. For account access, the terms are narrower. Onboarding is what you set up when a person starts or moves to a new role. It also covers people who join for a while, such as temps, contractors and helpers from other teams. Offboarding is what you shut off when they leave, change roles or finish a contract. In HR and recruiting, this includes permission to use shared company logins, such as a job board’s employer account.
One US reference for these steps is NIST SP 800-53 Rev. 5, a catalog of security controls. It is required for federal information systems, and other organizations may use it on a voluntary basis. The controls below come from it.
What does onboarding set up?
Onboarding sets up four things.
- A login of the person’s own. Control IA-2 asks you to identify and authenticate each organizational user uniquely, and its discussion includes contractors you treat like employees.
- Only the access the job needs. AC-6, least privilege, limits access to what a person needs for their assigned tasks. AC-2 e asks for an approval before an account is created.
- A place on the user list of each shared account. AC-2 d asks you to specify the authorized users of each account. A job board login that the whole team uses still needs a written list of who may use it.
- Signed access agreements. PS-6 asks people to sign agreements, such as a nondisclosure or acceptable use agreement, before they get access.
What does offboarding shut off?
Control PS-4, personnel termination, lists what to do when employment ends. You disable the person’s access within a period you set, and you revoke their passwords and other sign-in methods. You hold an exit interview that covers security topics, and you collect company property. You also keep access to the information and systems the person controlled. The discussion of PS-4 names property such as keys, ID cards, building passes and hardware sign-in devices.
That gives four things to shut off.
- The person’s own logins. Disable them first. Keeping the account disabled, not deleted, preserves access to files and records the person controlled (PS-4 e).
- Their use of shared accounts. Take them off each account’s user list, then change the password. AC-2 k asks for a process to change shared account passwords “when individuals are removed from the group.”
- Company property. Collect laptops, phones, badges, keys and any hardware sign-in devices (PS-4 d).
- What they still owe you. The exit interview reminds them of nondisclosure agreements (PS-4 c and its discussion).
A shared password stays in a person’s memory after they leave. Changing it is the only way to make what they know useless. The limits of changing shared passwords every time someone leaves covers the work that follows.
Why does HR start both?
HR knows first when someone joins, moves or leaves, so HR’s dates drive both lists. AC-2 l asks you to align account management with personnel termination and transfer processes. AC-2 h asks that account managers be told within a set period when users are terminated or transferred.
Transfers count too. PS-5, personnel transfer, asks you to review whether a person still needs their current access when they move to another role, and to change it to fit the new one. Without this step, access piles up with each move.
Timing matters most at a termination for cause. The PS-4 discussion calls timely action essential in that case. It also says that in some situations you may disable the person’s accounts before they are told.
The steps apply to everyone who gets a login, not only full-time staff. Seasonal hires, temps and contractors start and end too. PS-7 asks you to require outside firms that supply people, such as staffing agencies, to tell you when their people who hold your logins leave or move. The step-by-step version is the account checklist for onboarding and offboarding employees, and the full picture is in Managing HR and recruiting accounts.
Frequently asked questions
Is account onboarding the same as employee onboarding?
No. Employee onboarding covers the whole start, from paperwork to training. This article covers only the account part of it, which is logins, access rights and permission to use shared accounts.
Should we delete or disable a former employee's account?
Disable it first. NIST SP 800-53 PS-4 asks you to disable access and also to keep access to the information the person controlled. Delete later, once you know what the tool erases with the account.
Do temps and contractors go through the same steps?
Yes. NIST SP 800-53 IA-2 includes contractors you treat like employees among the users you identify one by one, and PS-7 asks you to require outside firms to tell you when their people leave or move.
What does offboarding mean for a shared account?
Take the person off the list of people allowed to use it, then change the password and give the new one to those who stay. NIST SP 800-53 AC-2 k asks for a process to do this.
How Junify handles this
- Doing this by hand
- You set up job board and HR system access person by person, add and remove it whenever seasonal staff come and go or an RPO partner starts or finishes, and keep track of who opened applicant data.
- With Junify
- With Junify, onboarding is an admin adding the person and assigning the accounts they need, and offboarding is removing those assignments. People never receive the shared passwords, so there is nothing to change and send out again when someone leaves. Junify records who used each account and when, person by person.
Sources
-
Handing job board accounts to an RPO partner
Add the partner's recruiters as users wherever the board allows it. If the CCPA covers you, the partner also needs a contract with service-provider terms.
-
Why a shared admin login in HR and payroll systems is a problem
With a shared admin login, anyone with the password sees Social Security numbers, and no log shows who changed pay. SSN laws, the CCPA and SOX ask about access.
-
Managing Indeed employer account users with an RPO partner or a hiring team
Indeed's terms say account access may not be shared, so add each person as a user. Admins add and remove users on the Users page. Removed users aren't notified.