Joiners, Movers and Leavers Access Checklist

Product details

When someone joins, changes role or leaves, their access should change too.

This is a self-serve checklist for UK small business owners and office managers with staff or contractors. It's built around the "joiners, movers and leavers" process that the NCSC's identity and access management guidance describes.

What's inside

• Your access list: a table to note every system people sign in to, who the admin is, and where to remove a user
• Joiner checklist: setting up only the access someone needs, with their own login and 2-step verification
• Mover checklist: adding new access and taking away what the old role needed
• Leaver checklist: blocking sign-in, saving company data before anything is deleted, devices, email forwarding, shared passwords and admin rights
• Notes for Microsoft 365 and Google Workspace, drawn from each provider's own help pages
• An "accounts no longer needed" review to repeat every few months
• An access record to log every change, with who did it and who checked it, in the PDF and as an editable spreadsheet (XLSX)

Who it's for

• UK small businesses with staff, part-timers, contractors or volunteers
• Owners and office managers who look after the accounts themselves, without an IT team

Cyber Essentials

If a customer has asked about Cyber Essentials, the checklist quotes one line from the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), under user access control: "remove or disable user accounts when they're no longer required (for example, when a user leaves the organisation or after a defined period of account inactivity)". It isn't a Cyber Essentials assessment and doesn't cover the questionnaire. The Cyber Essentials Questionnaire Prep Kit covers that.

What it isn't

It isn't HR or employment-law advice. It doesn't cover contracts or notice periods, only access.

Secordit isn't part of the government, the NCSC or the ICO, and none of them has reviewed this checklist.

Format

A printable A4 PDF, plus the access record as an editable spreadsheet (XLSX) with the same columns. Digital download, so there's nothing posted to you.