How should teams manage WiFi access when employees join or leave the organisation?

Use a central identity source so access follows the user lifecycle instead of a shared WiFi password. When an employee joins, their account can be granted access immediately. When they leave, access should be removed automatically. That approach reduces the risk of former staff retaining network access and makes access reviews much easier to enforce consistently.

Why WiFi Access Should Follow the Employee Lifecycle

WiFi access is easiest to manage when it behaves like any other workplace access control: tied to a named user, granted from a central source, and removed when the person leaves. That avoids the operational drift that comes with shared passwords, where nobody can reliably tell who has access, who used it last, or whether old credentials are still circulating.

The practical benefit is consistency. Joiners can be onboarded without waiting for manual network changes, and leavers can be disabled at the same point their other accounts are revoked. That makes WiFi part of the normal identity lifecycle rather than a separate exception that security and IT teams must remember to clean up.

It also improves accountability. If access is assigned to individuals, teams can review who can connect, trace access decisions back to employment status, and align network access with role-based need instead of convenience or habit.

What Good WiFi Access Management Looks Like in Practice

Good practice is to connect WiFi authorization to the organisation’s central identity source, so the network accepts the same lifecycle events that drive onboarding and offboarding elsewhere. In many environments this is done through corporate directory services or wireless authentication backed by centralized access policy, not by handing out a password that outlives the employee.

That design matters because the access decision should change automatically when the person’s status changes. A new employee should inherit access once their account is active and their role is approved. A departing employee should lose access as soon as offboarding starts, without waiting for someone to remember the WiFi credential as a separate task.

Where possible, use individual authentication rather than a shared network secret. NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it ties access control and identification and authentication to the broader control environment. For organisations that want a more operational checklist, CIS Controls v8 reinforces account management and access control as everyday safeguards rather than one-off admin tasks.

How to Avoid Shared Password Drift and Offboarding Gaps

The biggest failure mode is treating WiFi as an exception to normal identity governance. Shared passwords spread quickly, get reused across teams, and often remain valid long after the employee who first received them has left. Once that happens, revocation becomes uncertain because the organisation no longer has a clean list of who possesses the secret.

For that reason, WiFi access should be removed by disabling the user’s access path, not by asking people to “remember to stop using it.” If the same access model is used for employees, contractors, and guests, then the policy needs clear separation so that each population can be turned off cleanly when their status changes.

ISO/IEC 27001:2022 Information Security Management supports this kind of lifecycle control because it links access governance to formal policy and operating discipline. For organisations that want to see how access restrictions are treated in a broader compliance context, EU NIS2 Directive also reinforces the need for controlled access and operational resilience around core systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-2 — Identification and Authentication (Organizational Users)	WiFi access here depends on user authentication tied to employment lifecycle.
	AC-2 — Account Management	Joiner-leaver WiFi access is an account lifecycle problem.
Recommendation — Tie wireless access to authenticated user identities and disable access at offboarding. Automate account enablement and revocation so network access follows employment status.
CIS Controls v8	CIS-5 — Account Management	WiFi access should be governed through managed account lifecycle controls.
Recommendation — Centralise account provisioning and removal so departed users lose access consistently.
ISO/IEC 27001:2022	A.5.15 — Access control	Wireless access needs policy-driven control over who can connect and when.
	A.8.5 — Secure authentication	User-specific WiFi access depends on secure authentication rather than shared passwords.
Recommendation — Define and enforce wireless access rules through formal access control policy. Use secure authentication for wireless access instead of shared network secrets.

Practitioner Guidance

What to prioritise: Put WiFi into the same joiner, mover, leaver process as email, VPN, and application access. If wireless access is managed differently, it will almost always lag behind offboarding and create residual access risk.

What to verify: Confirm that a leaver’s wireless access is actually tied to a revocation event from the central identity source, not a manual checklist item. Also verify that any shared guest or fallback network is segregated from employee access and has a separate expiry process.

Common mistake: Keeping one shared WiFi password for convenience while assuming offboarding is still effective. That approach makes revocation partial at best, because former staff, contractors, and copied credentials can all keep working until the password is rotated.

Practitioner takeaway: The strongest WiFi control is the one you do not have to remember to clean up, access should start from identity, end from identity, and never depend on informal password handling.