Contractor Offboarding Checklist
A contractor offboarding checklist removes access, recovers assets, preserves records, and confirms contractual obligations when contractors, consultants, temporary workers, or supplier staff leave.
Primary Audience & Scope
Vendor managers, procurement, IAM, HR, Security, Legal
When to Use
- •A workforce or third-party lifecycle event occurs.
- •High-impact access needs review.
- •Evidence of access decisions is required.
Interactive Work Area
Fill or track items interactively and copy out to your Clipboard
Template Table Structure
| Field | Working prompt | Item | Required evidence / record |
|---|---|---|---|
| Person or entity | Name, ID, role, organization, sponsor | Trigger | Departure, role change, contract end, review cycle, incident, exception |
| Access scope | Systems, data, facilities, privileged rights, groups, shared spaces | Decision | Keep, remove, modify, suspend, exception, investigate |
| Owner | Manager, IAM, data owner, vendor manager, Legal/HR as applicable | Due date | YYYY-MM-DD |
| Validation | Evidence that action was completed and reviewed | — | — |
Checklist Audit List
Sponsor confirms end date and systems used.
IAM removes accounts, groups, VPN, SaaS, repositories, and delegated access.
PAM removes admin roles and sessions.
Vendor confirms data return or deletion.
Devices, badges, keys, and tokens returned.
Shared accounts and service credentials rotated.
Project spaces and external collaboration access removed.
Post-offboarding validation evidence retained.
What Completion Looks Like
- 1Access decisions recorded.
- 2Removals validated.
- 3Exceptions time-bounded.
- 4Evidence retained.
- 5Owner and due date assigned.
Insider Risk Capability Framework™ (IRCF™) Alignment
Operationalize This Template in RiskTKO®
Use RiskTKO® or request ITMG® support to adapt this template, align it to the Insider Risk Capability Framework™, and connect the output to measurable exposure reduction. Privileged User Review Checklist