PRACTICAL WORK / TOLUWA STEPHEN ADEBAYO
Secure employee onboarding & offboarding
An approval-led checklist with ownership, evidence and acceptance criteria.
Demonstration sample • Synthetic scenario • Prepared with AI assistance for this portfolio; not a client deliverable or a record of a completed incident.
01 / WORK SAMPLE
A new starter should be ready—not overprivileged
Scenario: a fictional organisation is onboarding a remote operations coordinator. The manager has approved the role, start date, equipment and required systems. This sample does not include real employee data.
Access decision matrix
| Resource | Access / approval | Verification |
|---|---|---|
| Company laptop | Standard user / IT | Asset assigned; encryption and endpoint status checked |
| Email & collaboration | Standard licence / manager | Work account and mailbox tested |
| Operations workspace | Team membership / owner | Required folder opens; unrelated area remains restricted |
| Finance workspace | No access requested | No finance membership or direct share |
| Administrative roles | None by default | No privileged role assigned |
Before the start date
- Obtain an approved request from HR/manager through the official workflow. Verify identity and start date without relying on an unsolicited email.
- Record device ownership, serial/asset identifier and assigned custodian in the restricted asset system.
- Prepare the supported operating system, updates, approved applications, endpoint protection, encryption and management enrolment as required by the organisation.
- Create the account and group memberships from the approved role. Assign only the licences and permissions needed for work.
- Prepare a secure credential-delivery process, user-led MFA registration and recovery guidance. Keep secrets and recovery codes out of ordinary tickets.
Day-one acceptance
Verify sign-in, email, approved shared resources, remote access if required, device health and a user-completed task. Explain the support channel, phishing reporting and escalation route. Record acceptance and outstanding items.
02 / WORK SAMPLE
Make departures controlled and traceable
Scenario: a manager and HR have confirmed a scheduled departure. Actions follow the organisation’s retention, legal-hold and access policies; this checklist is an operating sample, not legal advice.
Offboarding control record
| Stage | Action | Evidence / owner |
|---|---|---|
| Authorise | Validate end time, manager and HR request | Approved ticket / HR |
| Secure access | Disable sign-in and revoke active sessions as supported; remove remote access | Timestamped admin record / IT |
| Preserve business work | Apply approved retention and transfer ownership to an authorised custodian | Custodian acceptance / manager |
| Recover assets | Collect equipment; confirm asset status and return accessories | Asset receipt / IT |
| Clean up | Review groups, shares, delegated access, SaaS accounts and licences | Completed checklist / IT |
| Verify | Confirm access removal and list unresolved exceptions | Closure review / IT and manager |
Exception handling
- If equipment cannot be recovered, escalate to the device/security owner. Remote wipe requires the appropriate approval and consideration of evidence and retention needs.
- If there is a legal hold or unresolved ownership question, preserve data and obtain instructions before deletion.
- If sign-in remains possible or an active session persists, keep the ticket open and escalate with evidence.
- A shared account or undocumented service dependency is an exception to investigate, not a reason to leave a personal account active indefinitely.
Closure note
“Offboarding completed at the authorised time. Sign-in and remote access were removed, business data ownership was accepted, and asset recovery was recorded. Outstanding items: none in this fictional example. The approval and verification records remain in the restricted service system.”