Use: complete per separation. Owner: CHRO + IT/Security. File the completed checklist (ticket) in the HR system / Linear. Frameworks: SOC 2 IAC-8 (access revoked upon termination); supports CC6.2/CC6.3. Implements the Offboarding Procedure. Vanta slot:
employee-termination-checklist.Fill-and-complete at separation. Replace every {{…}}. SLAs per the Offboarding Procedure: involuntary/for-cause within 1 hour; voluntary by end of last business day.
Separation details
- Employee: {{employee_name}} · Role: {{employee_title}} · Manager: {{manager_name}}
- Separation type: {{separation_type}} · Last day: {{last_day}}
- Triggered by (CHRO): {{triggered_by_name}} · {{triggered_by_timestamp}}
Access & accounts
| Step | Owner | Done (timestamp) |
|---|---|---|
| Disable user in IdP (Rippling / Entra), revoke active sessions | IT | {{disable_idp_done}} |
| Remove from IdP groups / role bundles | IT | {{remove_groups_done}} |
| Revoke production access (AWS, Vultr, Vault, Tailscale, Cloudflare) | Security | {{revoke_prod_done}} |
| Rotate any shared secrets the user could access | Security | {{rotate_secrets_done}} |
| Revoke SSO app access (M365, GitHub, Linear, Better Stack, Dashlane, etc.) | IT | {{revoke_sso_done}} |
| Suspend / forward email | IT | {{email_done}} |
| Remove from Better Stack on-call, distribution lists | IT | {{remove_oncall_done}} |
Assets & data
| Step | Owner | Done |
|---|---|---|
| Company device(s) returned / remotely wiped (Rippling MDM) | IT | {{device_return_done}} |
| Confidential data removed from personal storage (attestation) | Employee | {{data_removal_done}} |
| Confidentiality / post-employment obligations reminder issued | CHRO | {{confidentiality_reminder_done}} |
Sign-off
- IT / Security: {{it_security_name}} · {{it_security_date}}
- CHRO: {{chro_name}} · {{chro_date}}
Variables
| Variable | Description |
|---|---|
{{employee_name}} | Departing employee’s name |
{{employee_title}} | Employee’s role / title |
{{manager_name}} | Employee’s manager |
{{separation_type}} | Voluntary / involuntary / for-cause |
{{last_day}} | Last day of engagement |
{{triggered_by_name}} | Name of the CHRO who triggered offboarding |
{{triggered_by_timestamp}} | Timestamp the offboarding was triggered |
{{disable_idp_done}} | Timestamp — IdP user disabled / sessions revoked |
{{remove_groups_done}} | Timestamp — removed from IdP groups / role bundles |
{{revoke_prod_done}} | Timestamp — production access revoked |
{{rotate_secrets_done}} | Timestamp — shared secrets rotated |
{{revoke_sso_done}} | Timestamp — SSO app access revoked |
{{email_done}} | Timestamp — email suspended / forwarded |
{{remove_oncall_done}} | Timestamp — removed from on-call and distribution lists |
{{device_return_done}} | Timestamp — device returned / wiped |
{{data_removal_done}} | Timestamp — confidential data removed from personal storage |
{{confidentiality_reminder_done}} | Timestamp — confidentiality reminder issued |
{{it_security_name}} | IT / Security sign-off name |
{{it_security_date}} | IT / Security sign-off date |
{{chro_name}} | CHRO sign-off name |
{{chro_date}} | CHRO sign-off date |