IT Onboarding and Offboarding Checklist for Growing Houston Companies

What Is an IT Onboarding Checklist?

An IT onboarding checklist is a repeatable list of technical tasks completed when a new employee joins: creating accounts, issuing and configuring a device, assigning access, enabling security controls and training the person to use them. Its job is to make sure a new hire is productive and secure on the first day, instead of waiting days for logins while someone searches for a spare laptop.

Its mirror image is the IT offboarding checklist, which covers everything that must happen when someone leaves, whether they resign, are laid off, finish a contract or are dismissed. Used together, the two lists cover the full employee lifecycle from an IT point of view: join, change roles, leave. A growing company that only writes the first list ends up with former staff who still have working logins, which is the more dangerous gap.

What Should an IT Onboarding Checklist for a New Employee Include?

A complete new-employee IT checklist covers five areas: identity and accounts, device, software and data access, security controls, and first-day training. Each area should have a named owner and a done-by date, so nothing depends on someone remembering to ask.

1. 1Confirm the start date, job title, manager and department with HR, and create a ticket that every later task attaches to.
2. 2Create the user account in your identity provider, such as Microsoft 365 or Google Workspace, with a standard naming convention and a company email address.
3. 3Enroll the account in multi-factor authentication before first login, and set up a password manager so credentials are never emailed or written down.
4. 4Assign access by role, not by copying a colleague. Add the person to the correct groups, shared drives, line-of-business applications and distribution lists, and nothing more.
5. 5Prepare the device: order or pull from stock, install the operating system image, apply updates, install endpoint protection, enable disk encryption and enroll it in device management.
6. 6Configure supporting access: printers, VPN or remote-access tools, shared mailboxes, phone or softphone number and any building badge or Wi-Fi credentials.
7. 7Record the asset: serial number, assigned user, purchase date and warranty end date in your inventory.
8. 8Deliver the device on day one, walk the new hire through sign-in and MFA, and share the short list of security rules, such as phishing reporting and approved file-sharing tools.
9. 9Check back after the first week to fix missing permissions, and confirm the new hire's access matches the role.

The MFA and least-privilege steps are not just preference. CISA explains why you should require multifactor authentication on every account, and the FTC's cybersecurity guidance for small businesses recommends limiting employee access to only the data and systems each person needs.

Do not skip the device step. A new laptop that is not encrypted, patched and managed is the weakest link in the whole process, and the same laptop fleet is what a managed plan monitors. If you are not sure whether to buy new or reuse stock, our guide on whether to buy a new computer or upgrade the one you have explains when an older machine is still good enough for a new hire.

When Should IT Onboarding Start?

IT onboarding should start as soon as the offer is accepted, ideally one to two weeks before the start date. Hardware orders, license purchases and account creation take longer than people expect, and doing the work in advance means the new hire receives a ready laptop and working logins on day one.

• Offer accepted: HR notifies IT with the role, start date and manager, and IT opens the onboarding ticket.
• One to two weeks before: order or reserve hardware, buy licenses, create the account in a disabled or pre-start state and build the device.
• Day before: test sign-in, MFA enrollment and access to key applications from the prepared device.
• Day one: hand over the device, complete the sign-in walkthrough and confirm everything works.
• Week one: collect feedback, correct permission gaps and close the ticket.

What Should an IT Offboarding Checklist Include?

An IT offboarding checklist should revoke access first, then preserve data, then recover hardware, then clean up licenses and records. The order matters: disabling the account in your identity provider on the last day cuts off email, cloud apps and VPN in one move, and everything else can be handled safely afterward.

Day 0: remove access

• Disable the user in your identity provider or single sign-on and sign out all active sessions on web, mobile and desktop.
• Revoke VPN, remote-desktop and remote-management access, and remove the person's devices from MFA.
• Reset any shared passwords, service accounts and vendor-portal logins the person knew, including Wi-Fi and alarm codes where relevant.
• Block the account from sending email and convert it to a shared mailbox or set forwarding to the manager.
• Deactivate badges, keys and any physical access to the office or server room.

Days 1 to 7: preserve and hand over data

• Transfer ownership of cloud files, shared drives, calendars and project or CRM records to the manager or a named successor.
• Back up the mailbox and any local files before anything is deleted, and decide how long that archive is kept.
• Set an out-of-office or auto-reply that points customers to a current contact.
• Reassign administrative roles, scheduled jobs and any automations that ran under the person's account.

Days 1 to 30: recover hardware and close out

• Collect laptops, phones, tokens, security keys and accessories, and check them against the asset inventory.
• If a device is not returned, lock or remotely wipe it through device management and document the attempt.
• Wipe and reimage returned equipment before reassigning it, or send it for a hardware check first.
• Reclaim and reassign software licenses so you stop paying for unused seats.
• After the retention period, delete or archive the account, and record the completed steps with dates for your own audit trail.

Returned machines are an opportunity, not just a chore. A quick diagnostic often shows whether a laptop needs a battery, a drive or a screen before it goes to the next person, and our guide to laptop repair costs and turnaround times in Houston shows what those fixes typically cost compared with buying new.

How Fast Should Access Be Removed When Someone Leaves?

Access should be removed at the moment the employee's employment ends, or within the same business day at the latest, and earlier for involuntary departures. Delay is where most offboarding risk sits: an account that stays active for weeks can still read email, reach customer files and sign in to cloud applications. The CISA Cross-Sector Cybersecurity Performance Goals include revoking credentials for departing employees as a basic control, and the NIST account-management controls in SP 800-53 call for disabling accounts promptly once they are no longer needed.

Plan the timing with HR in advance. For a planned resignation, schedule the account disablement for the end of the final shift. For a dismissal, access should be removed before or during the conversation, with a manager and IT working from the same checklist.

Where Can I Get a Free IT Onboarding Checklist Template in Word, PDF or Excel?

You can build a free IT onboarding and offboarding template in about ten minutes by copying the numbered lists on this page into Word, Excel or Google Sheets. Most downloadable templates are the same list in a table, so the format matters less than assigning owners and dates to each line.

• Word or Google Docs: best for a printable checklist that a manager signs off on. Keep one page for onboarding and one for offboarding.
• Excel or Google Sheets: best for tracking several people at once. Use columns for task, owner, due date, status and notes.
• PDF: useful for handing a fixed copy to new managers, but it cannot track progress, so pair it with a ticket.
• Ticketing system: the best option once you have a help desk, because tasks, timestamps and approvals are captured automatically.

Whatever format you choose, add four columns that generic templates often omit: the system name, the account owner, the date the step was completed and who checked it. Those four columns are what you will want if a customer, insurer or auditor ever asks how you remove former staff.

Why Does This Get Harder as a Houston Company Grows?

Onboarding and offboarding get harder with growth because the number of systems, locations and people multiplies faster than the process does. A 5-person office can remember every login; a 30-person company with remote staff, contractors and a dozen cloud applications cannot, and informal habits start leaking access.

Seasonal peaks make this concrete. In our guide to IT support for accounting firms in Houston, we describe how tax practices add preparers in January and release them in April, which turns fast, clean provisioning and offboarding into a core security task. The same pattern applies to Houston construction, energy services, logistics and staffing firms that scale crews up and down with project cycles.

The security basics also apply to the people who are joining, not only those who leave. New employees are a common target for phishing because they do not yet know who sends what, so cover the habits in our tips for avoiding computer viruses and malware during the first-day walkthrough.

Who Owns the Checklist: HR or IT?

HR owns the trigger and IT owns the execution. HR knows when someone is hired, changes roles or leaves, so HR should open the request; IT knows what has to be created or removed, so IT should complete and sign off on the technical tasks. Managers confirm which access the role needs.

• HR or the hiring manager: sends the start date, role and end date, and confirms what access is appropriate.
• IT or your IT provider: builds accounts and devices, removes access and records the completion dates.
• Finance or operations: tracks license costs and equipment return.
• The employee's manager: receives the data handoff and confirms nothing business-critical is missing.

If no one is clearly named, the first task to slip is offboarding, because nobody feels urgency about a person who is no longer in the building. Write the owner on the checklist itself and review it every quarter.

Should You Automate It or Hand It to a Managed IT Provider?

Companies with fewer than about ten employees can usually run these checklists by hand with a shared spreadsheet. Beyond that, either automate with an identity provider and device-management tooling or hand the process to a managed service provider, which already has the tools, templates and technicians to complete it consistently.

Onboarding and offboarding are routine, ticket-driven work, and they are exactly what a managed plan bundles in alongside monitoring, patching and backups. If you are weighing the cost of that model, our breakdown of managed IT services in Houston and what they cost shows typical per-user pricing, and our list of 10 questions to ask a managed service provider in Houston includes how fast they handle new-hire and departure requests.

A useful test when interviewing any provider: ask for their standard offboarding procedure and their target time to disable an account after you notify them. A clear, written answer is a good sign; a vague one is a red flag.

How Positive Technology Helps Houston Companies With Onboarding and Offboarding

Positive Technology runs from a walk-in office at 1000 Cypress Creek Pkwy #201C in North Houston, with a 4.9 Google rating and same-day service for many issues. For growing businesses we set up new-hire accounts and devices, remove access when staff leave, recover and refurbish equipment, and keep an asset and access record you can show an insurer or auditor. See our Houston business IT services for what is included, or call (832) 989-4686 for a free assessment.

If your team still handles departures informally, the quickest improvement is a single written checklist and a named owner. Our guide to choosing the best computer service in Houston and our computer repair cost and turnaround guide can help with the hardware side of that plan.

Frequently Asked Questions