When staff leave: close every access route, not just the email account
A returned laptop does not prove cloud access has ended. Build an evidenced handover that also respects privacy and record-retention needs.
The returned laptop is not the whole perimeter
A departing employee hands over the company laptop, but still has a personal phone session, a cloud invitation or a recovery method attached to an old account. No malicious intent is necessary for this to become a security problem. This dossier, checked on 15 October 2026, turns the departure into a controlled access handover. OFCS guidance emphasises knowing users and systems, protecting sensitive access and keeping credentials personal. The practical extension is to inventory the actual access routes before disabling them. A single email account is rarely an adequate description of a modern small business's digital perimeter.
Give the departure one accountable owner
Set the time at which access should end, with HR, the manager and the IT provider agreeing on responsibilities. Include email, shared storage, accounting, customer platforms, banking rights, website administration, social media, remote access and physical badges. Identify personal recovery addresses, delegated permissions, external guest accounts and shared secrets. Transfer legitimate business ownership to an authorised person rather than sharing the departing user's password. Keep the process proportionate and respectful. Before deleting mail or files, establish retention, privacy and any legal-hold requirements; immediate destructive cleanup can erase evidence or documents the business must retain for a legitimate purpose.
A hypothetical twelve-system checklist
Imagine a consultancy lists twelve services used by a departing account manager. Eleven are disabled, but the customer-management platform remains accessible through a separate account. The apparently completed laptop handover has therefore left a route to client information. In this invented example, reviewing the provider's user list reveals the omission before any misuse is identified. Record completion for each service and test the relevant permissions with the administrator. Do not conclude that every open account caused a breach, or that disabling a login necessarily invalidated every active session or token. Ask the platform specialist to confirm what the action actually does.
Link the controls to the insurance answers
Read the cyber policy's security declarations and notification conditions. If an access-control commitment was made at underwriting, keep evidence that the operational process matches it. Ask how unauthorised use of valid credentials, a former employee's access and suspected data extraction are treated; do not assume all fall under one guaranteed benefit. Outsourcing IT tasks does not remove the need to confirm completion. If compromise is suspected, contact the designated response team, preserve logs and assess personal-data implications. The PFPDT notification guide helps distinguish the legal assessment from an insurer notification; one communication does not automatically satisfy the other.
Make the next departure easier to verify
Use a dated checklist with system owner, action, completion evidence and unresolved item. Revoke or rotate shared credentials where necessary, remove obsolete recovery methods and confirm returned hardware is handled under the approved process. Arrange a second review of particularly sensitive services. Afterward, review dormant accounts periodically rather than waiting for another resignation. This is not a demand to monitor former staff indiscriminately; it is a controlled reduction of unnecessary access. Insurance may finance defined consequences of a covered incident, but it cannot substitute for knowing which permissions are still active after someone has left the business.
Sources and further reading
Original Clearwise analysis. External reporting provides context; rules and contract terms must be verified with the competent authority or provider. Some press articles may require a subscription.
Apply this to your situation
Compare your actual documents and clarify what matters before making a commitment.
Request a free consultationGeneral guidance, not a binding quote or personalised legal, tax or investment advice. Examples are hypothetical and results are not guaranteed.
