Whether it’s a contractor wrapping up or a cofounder parting ways, lingering access is a gift to future incidents.
Same-day checklist
- Revoke email and force logout of sessions
- Remove from password manager shared vaults
- Remove from GitHub/GitLab, cloud, CRM, ads, bank (as applicable)
- Rotate shared credentials they knew
- Transfer ownership of docs and domains
- Confirm device return / remote wipe
- Update customer-facing contacts if they were a point person
Prevent the mess next time
Use individual accounts + groups. Avoid “the intern knows the root password.” Document owners for each critical system.