Access follows people, but almost never at the same speed
Access often arrives late, or never goes away. The new sales rep spends the first few days with no PC and no account, and a colleague lends them their own. The employee who moves from accounts to purchasing keeps the bookkeeping folders and is given the supplier ones as well. The technician who resigned in March still has active VPN access in June: it is an orphaned account, still active with nobody left to answer for it.
None of these cases comes from bad intentions: they happen because nobody has the job of noticing. The cycle is known as joiner, mover, leaver (people joining, changing role, leaving), and the weak point is almost always the same: joining gets noticed because someone complains, changing role and leaving do not.
The three phases, and what needs doing in each
| Joining | Changing role | Leaving | |
|---|---|---|---|
| Typical risk | Lost days, credentials borrowed from a colleague | Old permissions stay, new ones are added | Accounts active for weeks after the last day |
| What to do | Account, email, PC, phone, VPN, role groups | Remove the previous role's groups, add the new ones | Disable, revoke, recover devices and data |
| When | Before day one | On the day of the change, not months later | On the day they leave |
Role changes are the most neglected phase. Someone who holds two or three roles over a few years carries the permissions of each one with them: this is privilege creep, and it turns an ordinary account into the most valuable one to steal.
Permissions by role, not person by person
The principle to start from is least privilege: everyone has the access their work requires, and no more. It is one of the pillars of Zero Trust. Applied person by person, however, it breaks down.
Thinking in groups works better: accounts, warehouse, export sales. Permissions are given to the group and each person joins the group for their role: when they change role they change group, and the old access disappears automatically. And if the main applications use Single Sign-On, meaning signing in with the company account instead of separate credentials, disabling that account closes every door at once: a single point of revocation.
The day someone leaves, step by step
- Disable the accounts, do not delete them: on the day itself, at the agreed time. Deletion comes later, once email and files are safe: in many cloud services, deleting the user starts a countdown after which their data can no longer be recovered.
- Revoke MFA and registered devices: authenticator apps, phones linked to the account, sessions still open. A session that has already started can remain valid even after the password is changed.
- Change the shared credentials the person knew: the info@ mailbox, the guest Wi-Fi, the phone system admin panel, the website admin. With a business password manager you know straight away which they are.
- Recover company property: PC, phone, badge, USB sticks. If a list was signed when the items were handed over, on the day they leave you just tick it off.
- Transfer files and folders to whoever is carrying on the work, including ownership of shared documents.
- Close access to external services that do not go through the company account: the company's social media profiles, supplier portals, online banking. These are the logins nobody remembers, because nobody has ever listed them.
The cleanest solution is an automatic reply, for a set period, telling customers and suppliers who to write to, for example a shared departmental mailbox. Keeping the mailbox active in order to read it, or forwarding it automatically to a colleague, touches on the confidentiality of correspondence, an issue on which the Italian Data Protection Authority (Garante) has ruled several times. The rule should be decided in advance, with whoever handles privacy, and written into the company policy.
Difficult departures
With a dismissal or a contentious departure, timing matters more than usual. Disabling access should be coordinated with HR around the time of the meeting: doing it beforehand causes a stir, doing it afterwards leaves a window in which the person can download or delete data. For accounts with elevated privileges, it is worth preparing the list of access rights in the days before.
Who does what, and the periodic review
The arrangement that works is simple: HR gives notice of the dates, IT carries out the steps following a written procedure, the manager confirms which access is needed and, when someone leaves, that none has been missed. If a step depends on someone's memory, sooner or later it gets skipped: that is why the procedure has to be written down, as explained in the guide on IT that lives in one person's head.
Something will slip through anyway. That is why, at fixed intervals, each manager receives the list of access rights in their department and confirms or removes them. This is the review of access rights also required by the ISO/IEC 27001 standard, and in an SME it does not need a project: it needs a calendar.
The most common mistakes
- Copying a colleague's permissions. Asking for permissions "the same as Mario" means also inheriting the exceptions Mario has built up over the years.
- Treating a role change like onboarding. Access is added and nothing is removed.
- Accounts used by several people. When one of them leaves, nobody changes the password, because everyone else would have to be told.
In short
Access should be granted before day one, changed on the day of the role change and removed on the day someone leaves. Group-based permissions and a single point of revocation make the work sustainable; a procedure shared by HR, IT and managers makes it reliable; a periodic review catches whatever slips through.