People joining and leaving is the most routine event in a law firm and one of the most common sources of avoidable security gaps. A new associate who waits three days for a working laptop wastes billable time. A departed paralegal whose account stays active for six months is an open door.
A written checklist, owned by someone specific, solves both problems. Below is a framework you can adapt to your firm.
Onboarding: start before day one
Ideally HR or the office manager notifies IT at least a week before the start date. The request should include name, role, supervising attorney, office location, and which matters or practice groups the person needs to access.
Accounts and access
- Create the user account with a unique login. Never share credentials between staff.
- Assign licenses for email, document management, practice management and any specialized tools.
- Enroll multi-factor authentication before the person gets access to anything else, and register a backup method.
- Add the user to the correct security groups and ethical walls. Conflicts and screening restrictions should be applied from the beginning, not retrofitted.
- Set up the mailbox, calendar, signature and any shared mailboxes.
Devices
- Prepare a laptop with full-disk encryption, endpoint protection, current patches and the firm's standard software.
- Configure the phone for firm email with a screen lock and the ability to remove firm data if lost.
- Assign a printing profile and phone extension or softphone.
Day one
- Hand over the equipment with a short walkthrough.
- Review the acceptable use policy and have the person acknowledge it in writing.
- Provide security awareness training covering phishing, wire fraud and handling client data.
- Show how to reach the help desk and what to do about a suspicious email.
Offboarding: speed and order matter
The departing person's last day is not the only date that matters. For involuntary departures, access should be removed at the moment of notification or immediately before it. For voluntary ones, plan a schedule so work transfers cleanly.
On the day of departure
- Disable the account and revoke active sessions and tokens, not just the password.
- Remove MFA registrations and trusted devices.
- Reset passwords on any shared accounts the person knew.
- Remove the user from practice-management and document management systems, and from remote access.
- Collect laptops, phones, security keys and badges, or remotely wipe firm data on personal devices.
Mail and data
- Convert the mailbox to a shared mailbox, or set up forwarding to the supervising attorney, so client communications are not lost.
- Set an out-of-office message with a contact person.
- Transfer ownership of files, matters and cloud documents before deleting anything.
- Preserve data according to your retention policy and any legal hold. Deleting a departed attorney's mailbox can be a problem if a matter is subject to preservation duties.
Often forgotten
- Third-party accounts such as court e-filing, state bar portals, legal research subscriptions and payment platforms
- Social media or marketing accounts the person managed
- Personal cloud storage where the person may have copied client files
- Remote-access and VPN profiles
- Conference-line and e-signature accounts
Assign ownership and track completion
A checklist only works if someone is accountable. Use a ticket for each onboarding or offboarding event, assign it to IT, and require sign-off from HR and a supervising attorney. Review at least a quarterly list of active accounts against your current roster to catch anything that slipped.
Why this connects to professional duties
ABA Model Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized access to client information, and Rule 5.1 addresses supervisory responsibilities within firms. A consistent offboarding process is practical evidence of those efforts. Confirm requirements with your state bar.
Contractors and temporary staff
Contract attorneys, interns and temporary staff deserve the same process, with an expiration date set on their account when it is created. Expiring access automatically prevents the "we forgot" scenario.
Where we come in
Counsel Cyber includes onboarding and offboarding workflows in its managed IT service for firms. If you would like a checklist customized to your systems, we are happy to build one with you.