When offboarding covers only one side of the problem, organizations can still be exposed. Revoking app access without recovering devices leaves company hardware in circulation, while recovering devices without removing accounts leaves digital access open. A complete process should address identities, software licenses, and physical assets together so former employees cannot keep using company resources.
Why partial offboarding still leaves real exposure
Offboarding only works when it removes both the person’s digital reach and their physical ability to use company resources. If access is revoked but devices are not recovered, the former employee may still hold hardware that contains cached sessions, local data, certificates, or unmanaged software. If devices are recovered but access remains active, the account can still be used to reach applications, data, and shared services.
The practical problem is that offboarding is a lifecycle control, not a single action. It needs to close the identity, the device, and any recovery paths tied to that identity at roughly the same time. That is why lifecycle guidance for NHI Lifecycle Management Guide and the broader IAM and IGA Basics both treat deprovisioning as more than simple account disablement.
For software teams and IT operations, the key point is that the remaining asset can become a bridge back into the environment. A laptop, phone, badge, or key fob is not just inventory, it is often a surviving trust token that can keep sessions alive, preserve secrets, or support access resets if it is not recovered and wiped.
What goes wrong when one side is left open
Leaving either side open creates a different failure mode. Unrevoked access can support unauthorized login, lateral movement, license abuse, or continued use of SaaS and internal tools. Unrecovered hardware can support data exposure, local credential reuse, and unauthorized access through cached authentication material or unremoved certificates. The risk is higher when the leaver had privileged access, mobile access, or access to shared operational systems.
That is why joiner-mover-leaver discipline matters most at departure time, not after the fact. The offboarding process should be designed so the account cannot outlive the asset, and the asset cannot outlive the account. Joiner-Mover-Leaver (JML) Guide is useful here because it frames revocation, deprovisioning, and recovery as one control path rather than separate administrative tasks.
Former staff should also be treated as an identity-risk case until all links are closed. That includes removing active sessions, revoking tokens or keys tied to the person, collecting corporate hardware, and confirming that any recovery methods, forwarding rules, or managed devices no longer provide a path back into corporate systems. In practice, this is where Workforce Identity Security Guide is especially relevant because offboarding often fails through session persistence or recovery workflows, not only through password retention.
What a complete offboarding process should close
A complete process should remove access, recover assets, and verify that neither can be used independently. That means disabling or deleting accounts where appropriate, revoking active sessions and secrets, recovering physical devices and badges, and confirming software licenses or entitlements are no longer associated with the former worker.
- Revoke user access and any delegated access first enough to block continued use, then confirm no alternate login path remains.
- Recover company hardware, removable media, badges, and any device that can still reach corporate data or authentication flows.
- Check for linked artifacts such as tokens, certificates, cached sessions, recovery codes, and locally stored files that can preserve access.
- Validate that license reassignment, asset return, and account closure are all recorded before the offboarding case is closed.
For organizations that rely on machine, service, or other non-person credentials, the same logic applies to automation assets as well. A departed employee may not own the system directly, but they may still leave behind credentials or operational access paths that survive if offboarding only targets the human account. That is why lifecycle materials such as Ultimate Guide to NHIs, Lifecycle Processes for Managing NHIs are a useful companion when teams need to think about revocation and recovery as one control family.
Risk and Threat Considerations
When offboarding is split across separate teams or ticket queues, the gap between revocation and asset recovery becomes a live exposure window. An account may be disabled while a device remains usable, or a device may be returned while authentication material and access tokens remain active. That gap is enough for unauthorized access, data exfiltration, or continued use of corporate services.
Failure mechanism: The control fails when identity removal, session cleanup, and physical retrieval are not synchronized, allowing one surviving access path to compensate for the other.
Impact: Former employees may retain access to systems, data, or recoverable credentials, and organizations may also lose track of hardware, licenses, and evidence needed to prove the offboarding actually completed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Offboarding must revoke and rotate credentials, tokens, and recovery paths. |
| AC-2 — Account Management | Leaver offboarding is fundamentally account lifecycle control and deprovisioning. | |
| IA-4 — Identifier Management | Identity closure requires ensuring departed users no longer retain usable identifiers. | |
| Recommendation — Revoke or rotate authenticators and secrets when an identity leaves the organisation. Disable, remove, or transfer accounts promptly during offboarding. Retire or invalidate identifiers that should not remain active after departure. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Offboarding requires timely removal of access rights when employment ends. |
| A.7.9 — Security of assets off-premises | Recovered devices may still expose data and access if not controlled carefully. | |
| Recommendation — Remove access rights as part of every termination and transfer process. Recover and secure off-premises assets before closing the offboarding case. | ||
Practitioner Guidance
What to verify: Treat offboarding as incomplete until you can confirm both the identity and the asset are closed. A closed ticket should show account deactivation, session or token revocation, and asset return or wipe status, not just one of those events.
Decision rule: If the person had access to production, sensitive data, or privileged systems, do not accept “account disabled” as sufficient closure. Prioritise immediate access revocation, then confirm device recovery and secret cleanup before considering the case complete.
Practitioner takeaway: The real control objective is to eliminate every surviving path back into the environment, because either a live account or a retained device can keep the former user effectively present.
