Former employees keeping access is one of the most common and most preventable security gaps in small businesses. It is rarely malicious and almost always simply forgotten. A checklist fixes it.
Do it on the last day, not later
Access removal should happen as part of the departure, at the same time as collecting the laptop and the office key. Deferring it means it does not happen.
The checklist
- Website admin. Delete or disable their user account in WordPress or your CMS. Reassign their content to another user rather than deleting it, or you lose the posts and pages they authored.
- Customer portal. Remove their contact record at crm.zylax.com.my so they stop receiving ticket and invoice notifications.
- Email. Disable the mailbox, or convert it to a forward to a manager for a handover period. Do not simply delete it on day one if customers write to that address.
- Hosting and registrar. Remove any account they held directly, and change any shared password they knew.
- Payment gateways and bank portals. Highest priority. Remove the user and check for any API keys they created.
- Social media and advertising accounts. Check they are not the only admin before removing them, or you will lock yourself out.
- Third party tools. Analytics, marketing platforms, design tools, cloud storage, code repositories.
- Shared credentials. Any password they knew must be changed, not just their own account removed.
Watch for single points of ownership
Before someone leaves, check what is registered in their name or to their personal email. Domains, Google accounts, app store listings and social pages registered personally are painful to recover after a departure, especially an unhappy one. Move ownership to a company role address while the relationship is good.
Tell us
If the departing person was a contact on your Zylax account, let us know so we stop accepting instructions from them. We act on requests from verified contacts, and we can only keep that list accurate if you update it.
To request access changes, reply to your email thread or contact [email protected].
