Accounts that belong to former staff are easy to forget and hard to notice when misused. Most leavers mean no harm, but an old account with a weak or reused password is an open door, and nobody is watching it.
Cyber Essentials expects accounts to be removed or disabled when they are no longer needed.
How to check your own setup
Open the user list in Microsoft 365 or Google Workspace and compare it with your current staff. Then do the same for your accounting software, banking, CRM and any other online service. Anyone on a list who no longer works for you is a gap.
How to fix it
Use the same checklist every time, on the person's last day.
- Block sign-in to their email account and reset the password.
- Sign them out of every session and remove their MFA devices.
- Decide what happens to their email, for example forwarding it or giving a colleague access.
- Remove them from every other online service, such as accounting, banking, CRM, file sharing, social media.
- Change any shared passwords they knew, including the office Wi-Fi.
- Collect laptops, phones, keys and access cards, and wipe devices before reusing them.
The mistakes people make
- Leaving the account open "for a few weeks" in case something is needed.
- Forgetting the services outside Microsoft 365 or Google Workspace.
- Not changing shared passwords, so the leaver can still get in.
Got a question about this?
Ask me about your own setup and I'll give you a plain English answer, usually within one working day.