What should teams do first when offboarding a contractor?

Why the first offboarding action is access revocation

The first move is to cut off live access before you spend time on cleanup. If a contractor still has valid sessions, API keys, tokens, certificates or shared secrets, they can keep reaching systems even after the business has decided the relationship is over. That makes access revocation the control that stops further exposure from spreading.

This is also why offboarding has to be treated as an identity and access problem, not just an HR closeout. The practical task is to find every place the contractor was represented, authenticated or authorized, then remove those paths in a controlled order so that access cannot linger in parallel systems.

For a broader pattern on contractor offboarding, the Third-Party, B2B and Contractor Access Guide is the natural parent topic because it covers sponsorship, time limits and external-user access governance.

What has to be found and removed right away

Teams should look beyond the obvious directory account. A contractor may have a primary IAM identity, but also service accounts, shared mailbox access, cloud roles, repository privileges, VPN entitlements, API credentials and certificates tied to build, deployment or support workflows. The first pass should identify every active identity and every secret that still authenticates on the contractor's behalf.

That inventory matters because offboarding failures often come from incomplete discovery, not from slow execution. A contractor can be removed from one system and still retain effective access through a token issued elsewhere, a local admin path, an inherited group, or a shared secret that was never tied back to a named owner. The safest sequence is to revoke, then verify, then reconcile what remained.

For teams standardising this work, the Employee Offboarding Security Guide gives a practical offboarding pattern for sessions, tokens and SaaS access, while the Employee Offboarding Security Checklist is useful when you need a step-by-step last-day removal sequence.

What to do after access is cut off

Once live access is removed, teams should transfer ownership of data, repositories and cloud resources, then rotate any secrets that may have been exposed to the contractor. That includes API keys, signing keys, shared credentials and other material that may still work even after the person is deprovisioned. If the contractor had privileged access, confirm removal from groups, roles and external access paths before you close the record.

This sequence matters because deprovisioning alone does not neutralise what the contractor already knew or copied. Ownership transfer prevents orphaned assets, while rotation removes the value of any credential the contractor may have seen. The final verification step should prove that the access has actually been removed everywhere, not just in the primary directory or HR record.

For contractors specifically, the Contractor Identity Lifecycle Guide helps with sponsor ownership, expiry and offboarding outside HR, and the Joiner-Mover-Leaver (JML) Guide is the broader lifecycle reference for removing old access cleanly.

Risk and Threat Considerations

Delayed or partial offboarding leaves a live trust path in place. The main risk is not just unauthorized login, but continued use of sessions, tokens or keys that were already issued, which can preserve access after the contractor should have been fully removed. In contractor scenarios, that risk is amplified when access was shared across cloud, source control and SaaS platforms.

Failure mechanism: The contractor retains one or more valid authentication or authorization paths because the account was disabled in one system but not across all dependent systems, or because a secret, session or role was not rotated or revoked.

Impact: Unauthorised access can continue, owned resources can remain exposed, and the organisation may miss the point where the contractor's access should have been fully terminated.

Practitioner Guidance

What to verify: Do not trust a single deprovisioning event. Confirm that directory accounts, active sessions, API keys, service credentials, VPN access, cloud roles and repository permissions have all been removed or expired, and that any remaining shared assets have been re-owned or rotated.

Decision rule: If the contractor had access to production systems, signing material, code repositories or cloud control planes, treat credential rotation and ownership transfer as mandatory follow-on actions, not optional hardening.

Practitioner takeaway: The first offboarding task is to remove every live path back into the environment, because a clean HR exit is not complete until all effective access has been revoked and verified.

Related resources from NHI Mgmt Group

• Why do access governance failures often show up first in offboarding?
• Who should own contractor access decisions and offboarding?
• What happens when a contractor or service account is not tied to a clear ownership and offboarding process?
• What should HR, security, and managers do first to improve onboarding and offboarding control?