A practical law firm employee offboarding checklist does more than disable email. It accounts for client files, practice-management tools, remote access, physical keys, shared credentials, and the work that must continue after someone leaves.
The process should match the person’s role and actual access. A departing attorney’s transition is not the same as a staff member’s departure: the firm must protect its systems while handling client matters, notices, and file access with care. Treat access security and client-matter continuity as related but separate workstreams.
Prepare before the departure
Start with an inventory of the person’s access, not a generic list of applications. Ask the person’s manager, system owners, and IT support to identify the accounts and devices they used. Assign an owner to each action, and agree on when access changes will take effect.
- List systems and credentials. Include email, document management, practice management, cloud storage, e-filing, client portals, accounting tools, messaging, VoIP, VPN, remote desktop, and any line-of-business applications.
- Find less-visible access. Check shared mailboxes, distribution lists, delegated access, saved passwords, shared credentials, API keys, cloud administrator roles, and vendor accounts.
- Identify firm property. Record assigned laptops, phones, storage devices, keys, access cards, and any equipment used from home.
- Plan the record handoff. Identify open matters, upcoming deadlines, client communications, calendar items, and files that need a new owner.
- Set a preservation path. Decide who can preserve relevant email, files, and access logs before accounts or devices are changed. If misuse is suspected, escalate before deleting data or wiping equipment.
A written inventory makes it easier to verify that no access path was overlooked. NIST’s security and privacy controls publication provides a broader reference for managing access to information systems.
At the effective departure time
Coordinate the access change with the departure plan. For a staff member or contractor, disable the accounts and remote-access methods they no longer need at the agreed effective time. Avoid relying on a password change alone: an active session, recovery method, connected device, or separate vendor login may still provide access.
- Disable individual accounts and remove access from groups, shared folders, mailboxes, and collaboration spaces.
- Revoke active sessions, remote connections, authentication tokens, and application access where supported.
- Remove access to e-filing, client portals, cloud platforms, backup systems, and vendor tools, not just the firm’s main network.
- Change shared credentials the person knew, then provide new credentials only to current, authorized users.
- Remove administrative privileges and review any account or integration the person created or managed.
- Disable building access cards and collect keys when the person leaves the premises or returns firm property.
Keep a record of what was disabled, when, and who verified it. For a structured review of potential gaps, see Zevonix’s cybersecurity risk assessment guidance.
Adjust the checklist to the person’s role
Departing attorney
Secure firm systems while arranging a careful matter transition. Identify the lawyer’s active matters, current deadlines, client contact information, and relevant files. Decide how authorized firm personnel will handle the work while client communications and any transfer requests are addressed.
Do not treat client files as ordinary employee property or assume that cutting off every route to matter information resolves the transition. Client choice, confidentiality, and continuity matter. Florida lawyers should review the Florida Bar’s ethics guidance for lawyer departures and consult appropriate ethics counsel when the situation calls for it. Coordinate client notices and file access in line with the applicable professional obligations and the client’s direction.
Paralegal or legal assistant
Reassign matter tasks, calendars, shared mailboxes, and document workflows. Confirm that another authorized team member can find the records needed to continue the work. Remove the departing employee’s access to client portals and matter spaces without disrupting access for the rest of the team.
Administrator or office manager
Review access to billing, payroll, personnel records, scheduling, and firm-wide distribution lists. These systems may contain sensitive information beyond client matters. Transfer ownership of recurring administrative tasks and update approval workflows.
IT administrator
Give special attention to elevated permissions, recovery accounts, domain and cloud administration, backups, security tools, and vendor management portals. Confirm another authorized administrator can manage critical systems before removing the departing person’s privileges. Preserve records needed for review, then rotate any shared secrets they could access.
Contractor or vendor
End access through the firm’s systems and confirm that the outside provider has also removed the person’s access to firm data. Check for accounts created outside the firm’s normal user directory, including vendor support portals, temporary logins, and remote tools. Review the agreement and established data-handling process before requesting return or deletion of information.
Handle devices and personal equipment carefully
Collect firm-owned laptops, phones, storage devices, keys, and access cards, and record what was returned. Before reassigning or wiping a device, confirm that needed business records and relevant logs have been preserved. A device should not be erased simply to make it ready for the next person if doing so could destroy records the firm needs to retain or review.
For a personal device used for work, follow the firm’s written policy and remove firm access or firm data through an approved process. Avoid indiscriminately wiping a personal device. If there is uncertainty about preservation, privacy, or the scope of firm data on that device, pause and get appropriate guidance.
Verify the handoff and close the loop
After access changes, have someone other than the person who made them confirm the important items are complete. Test that former credentials no longer work where practical, review account lists for omissions, and confirm that the new matter owners can access the records they need.
- Confirm account disablement and removal from shared resources.
- Check remote access, mobile access, e-filing, client portals, cloud apps, and vendor accounts.
- Confirm firm property was returned and physical access was removed.
- Verify that client matters, deadlines, and internal responsibilities have a new owner.
- Document exceptions, unresolved access, and any required preservation or escalation.
Preserving records is part of a sound transition, not an afterthought. Review your firm’s retention and backup process before changing accounts or devices; this guide to testing business backups explains why recovery should be verified rather than assumed.
Frequently asked questions
How quickly should a departing employee’s accounts be disabled?
Plan the changes in advance and disable access at the agreed effective departure time. For sensitive or unexpected departures, coordinate promptly with firm leadership and IT support, while preserving records and maintaining any necessary matter transition.
Should a firm preserve a departing employee’s email and access logs?
Set a preservation process before closing or deleting accounts. Preserve records and logs when required by the firm’s retention practices or when a concern needs review. If there may have been misuse, escalate before altering or erasing potentially relevant information.
How should a firm handle client files when an attorney leaves?
Separate system security from the client-matter transition. Identify the matters and records involved, maintain confidentiality, and handle client notices, file access, and transfer requests in accordance with applicable professional obligations and client direction. Consult Florida ethics guidance or counsel for situation-specific questions.
What about remote workers and personal devices?
Include remote access, mobile sessions, saved credentials, and devices used for work in the inventory. Remove firm access through the approved process, collect firm-owned equipment, and handle personal devices under written policy without indiscriminately erasing personal data.
Make offboarding a repeatable security process
A dependable offboarding process ties each access path to an owner, a deadline, and a verification step. Tailor it to the departing person’s role, protect client confidentiality, and keep matter work moving through an orderly handoff. If your firm needs help reviewing its access controls or ongoing IT support, contact Zevonix at (386) 260-0777.