1
A timeline, not a to-do list
Items are grouped T-30, T-14, T-7, T-0, T+1 and T+30, so the work starts at notice of intent rather than on the last day.
What This Resource Includes
A checklist you fill in rather than read. Every row carries an owner, a target date, a status dropdown, a risk level and the control it satisfies.
2
Trackable inside the file
Status is a dropdown, the colour follows the selection, and the completion count at the top of the sheet updates as you go.
3
A contractor and vendor variant
A separate 15-item sheet for contractors, agencies and outsourced teams, whose exits rarely pass through the HR process at all.
Built Around What Actually Goes Missing
Departure risk concentrates in the weeks before anyone is told. This checklist front-loads the observation phase, then works through access reduction, asset recovery and evidence preservation in the order that keeps each step possible — you cannot pull a file trail from a device that has already been wiped and reissued.
- Access reduction split by system class: directory and SSO, mail, code repositories, SaaS accounts, long-lived tokens and shared credentials.
- Evidence preservation sequenced before the device wipe, so the endpoint trail survives the handover.
- A standards column on every row — ISO/IEC 27001:2022, NIST SP 800-53 Rev.5 and SOC 2 — plus a full mapping sheet for audit questions.
- Notes that explain why an item exists, so whoever fills it in can judge what to skip and what not to.
