Client Access Offboarding Runbook (Handoff)

Client Access Offboarding Runbook (Handoff)

1. 01

   Inventory every identity tied to the departing client

   Pull a list of all human, machine, and AI agent accounts that have access to client systems, including shared mailboxes, API keys, and service accounts. Use your IAM platform's discovery features to catch non-human identities that are often overlooked.

2. 02

   Classify each identity by risk and criticality

   Tag identities as high, medium, or low risk based on the sensitivity of the data they can reach and whether they have privileged access. This prioritizes the order of revocation.

3. 03

   Revoke access in a staged sequence

   Start with the most critical systems (financial, production, client data) and work down to lower-risk tools. For each identity, disable rather than delete where possible to preserve audit trails.

4. 04

   Rotate shared credentials and secrets

   Change passwords, API keys, and tokens that the client or its team may have known. This includes secrets stored in your password manager or secrets vault, such as those managed by Bitwarden or 1Password.

5. 05

   Document the revocation and notify the client

   Record the date and time each access was removed, and send a summary to the client contact. This provides a clear audit trail and reduces disputes about lingering access.

6. 06

   Verify no residual access remains after 72 hours

   Run a follow-up scan to confirm that all identities are disabled and no new access has been granted. This catches any missed items or auto-provisioning that may have recreated accounts.

7. 07

   Archive the offboarding report for compliance

   Store the inventory, revocation log, and client notification in a secure location. This supports future audits and demonstrates due diligence if a breach occurs later.