Account and access handover checklist

When someone leaves a small charity, their logins often stay behind: an admin role on the social media page, the only key to the domain name, a shared folder in their personal cloud account. Months later, nobody can update the website, or a former volunteer still has access to donor records. This checklist makes the handover routine, so it happens the same way every time, kindly and completely.

The federal cybersecurity agency CISA's Cyber Essentials asks organizations to "maintain inventories of network connections (user accounts, vendors, business partners, etc.)", to grant "access and admin permissions based on need-to-know and least privilege", and to "develop IT policies and procedures addressing changes in user status (transfers, termination, etc.)." This checklist is that procedure for a small team. Our cybersecurity basics guide explains the reasons behind each step, and our guide to succession planning covers handing over a key role.

How to use it

• Start before the last day when you can. A planned departure gives time to move files and train the next person. If someone leaves suddenly, work through the "On the last day" section the same day.
• Use your account list. If you keep a technology inventory, work through every account on it. If you don't, this is a good moment to start one.
• Never ask for someone's personal passwords. Ask them to transfer ownership, or to add a new admin before they're removed.
• Be kind about it. Removing access isn't a sign of distrust. It protects the person leaving as well as the charity, and it's the same for everyone.
• Wipe devices properly. The FTC's guide to protecting personal information recommends limiting access to people with a "need to know" and, for old computers, using "software for securely erasing data, usually called wipe utility programs."
• Check your state's rules. How you tell your state about a change of officers, directors or registered agent, and the rules on personal information, vary by state. Check your secretary of state's or charity regulator's website and follow your bylaws.
• Keep the completed checklist with your records, in line with your document retention policy.