Access risks at shutdown: revoke departing staff without losing the archive

How do you revoke access at shutdown without losing records?#

Revoking access at shutdown without losing records means separating two jobs that normal offboarding combines: cutting off the person and disposing of the account. At shutdown, cut off the person immediately and keep the account and its data until the archive is secured.

Normal offboarding often ends by deleting the user, which can remove the mailbox, drive files or chat history tied to that account. In a business that keeps running, a manager has already taken over the work. In a shutdown there is no successor, so a deleted account may hold the only copy of a customer thread or a project folder.

Suspend, transfer, export, then delete#

The sequence suspend, transfer, export, then delete protects both security and the archive. Each step has a different effect, so record which step every account has reached.

The two-admin rule and break-glass account checklist#

The two-admin rule means every critical system keeps at least two named, current admins until the archive is secured, so one resignation cannot lock the company out. The break-glass account is a separate emergency admin, unused day to day, whose credentials are sealed and held by an officer or outside custodian.

• 1List every system with admin rights: identity, email, file storage, chat, help desk, CRM, accounting, code hosting, cloud hosting and the domain registrar.
• 2Name two current admins for each, ideally an officer and the IT lead, and remove all other admins.
• 3Create or confirm a break-glass account on the identity provider and the most critical systems, with multi-factor authentication tied to company-held devices or hardware keys.
• 4Keep long-standing admin accounts active where vendors depend on account age, such as Google's rule for its Data Export tool.
• 5Confirm that a current person holds the owner role in systems where exports need the owner, such as Zendesk.
• 6Seal break-glass credentials and recovery codes in a record held by the officer or outside custodian.
• 7Test one break-glass sign-in, log it, then reseal the credentials.
• 8Set a date to retire break-glass accounts after the last export is verified.

System-by-system traps to check#

Offboarding traps differ by system, but the costly ones share a pattern: a routine step deletes data that only that account held, or removes the one role that can export it.

Retention settings that protect departed users' data#

Retention settings can protect a departed user's data, but only if they are in place before the account is removed. Microsoft documents that deleting the mailbox of a user covered by an active Teams retention policy converts it into an inactive mailbox that keeps the Teams data; without an active policy, that protection does not apply.

Google Vault works differently: data held or retained by Vault policies can be searched and exported by users an administrator has given the Manage Matters, Manage Searches and Manage Exports privileges. Assign those privileges to the two named admins early, and download each Vault export promptly, because the files do not wait. Vendor behavior changes, so test each step on one account before applying it to everyone.

Closing the side doors departing staff still hold#

Departing staff often keep access through side doors that a password reset does not close. Tokens, connected apps and forwarding rules survive a reset unless someone revokes them, and each one is a route for company records to leave.

Close each one and log it. Where staff hold company files on personal devices, ask for return or deletion in writing and record the answer; that statement matters if anyone later asks whether records left the company.

• 1Mail forwarding rules to personal addresses.
• 2OAuth connections from personal apps to company drives and calendars.
• 3API keys, personal access tokens and SSH keys in code hosting and cloud accounts.
• 4Shared passwords kept in personal password managers rather than company vaults.
• 5Synced folders on personal laptops and phones with company mail.
• 6Guest access in shared channels with customers or partners.

Illustrative: a consulting firm closes its offices#

Illustrative: a fictional operations consulting firm is closing after its founders retire. Consultants leave in waves over the final quarter, and the IT lead plans to delete each account on its departure date to stop paying for seats.

The managing partner changes the plan. Accounts are suspended, not deleted, and each consultant's drive files and mailbox move to a retained archive account. The IT lead and the CFO become the two admins on every system, the firm's outside counsel holds a sealed break-glass account, and a retention policy is confirmed before any mailbox is deleted. A simple access log records system, account, action, date, person acting and approver.

When the last export is verified, the seats are released and the log is filed with the archive. The firm keeps the engagement files it must retain and can still decide later what else to keep, delete or license.

How SourceX looks at access records#

SourceX reviews provenance before any records are licensed, and an access log showing who controlled each system from the last day of operations to the export makes that review shorter. The SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and release authorization for each package.

Nothing is shared during the initial fit check, which works from metadata such as systems, years covered and record types. If a package proceeds, the SourceX five-step transaction keeps the company's approval at every step, from Supply through Rights, Preparation and Approval to Delivery, and records are licensed, not sold outright.