Every law firm has a story about an account that stayed active months after someone left, or a new paralegal who waited a week for access and borrowed a coworker's password in the meantime. Onboarding and offboarding are routine, which is exactly why they fail: they live in someone's head instead of on a checklist.
Good processes protect confidentiality and reduce mistakes. They also support the supervision duties found in Model Rules 5.1 and 5.3 and give you a record when a carrier or client asks how access is managed. Below are practical checklists you can adapt.
Start with ownership
Decide who triggers each process. HR or the office administrator should notify IT of a start date and a departure date as soon as they are known, ideally with a standard form. Make the notification mandatory, not a courtesy.
Onboarding checklist
Before the first day
- Collect details: name, role, supervisor, start date, practice group and work location.
- Define access by role, using a standard template for attorneys, paralegals, assistants and billing staff, rather than copying a coworker.
- Order and configure equipment, with disk encryption, endpoint protection, updates and management enrolled before it ships.
- Create accounts: email, directory, practice management, document management, billing and phone.
- Assign licenses and add the user to the right groups and distribution lists.
- Prepare MFA enrollment and the password manager invitation.
First day and first week
- Hand over the device in person or ship it securely.
- Enroll MFA together with the person, and verify they can sign in.
- Set up the password manager and explain how to use it.
- Provide a short security briefing covering phishing, wire verification, approved tools and how to report problems.
- Have them sign the acceptable use and confidentiality policies.
- Confirm access to the right matters and nothing more.
- Introduce the help desk and show how to open a ticket.
First 30 days
Check in on how the setup is working, schedule security awareness training and confirm that access matches the job.
Role changes
When someone changes roles, treat it as a mini onboarding and offboarding. Remove access they no longer need, because privileges accumulate quietly over time. Review quarterly for long-tenured staff.
Offboarding checklist
Planned departures
- Receive notice and schedule a time for access removal, usually the end of the last day, or immediately in sensitive cases.
- Identify what they own: matters, shared mailboxes, delegated calendars, scheduled reports, vendor accounts and shared passwords.
- Plan the handoff of files and email, and decide who needs access to the mailbox.
On the last day
- Disable the directory account and block sign-in.
- Revoke active sessions and tokens, and sign the user out of all devices.
- Reset passwords for any shared accounts the person knew.
- Remove MFA devices and recovery methods.
- Collect laptops, phones, badges, keys and tokens.
- Remove the person from practice management, document management, billing and e-filing systems.
- Wipe firm data from personal devices, using selective wipe where possible.
- Forward or redirect email as decided, and set an automatic reply if appropriate.
- Retain mailbox data according to your retention policy, instead of deleting it, and convert it to a shared or archived mailbox as needed.
- Reclaim or reassign licenses.
Sudden or contentious departures
Cut access first and talk afterward. Have IT ready to act at the moment of termination, and preserve evidence if there is concern about data taking.
Contractors and temporary staff
Give contractors accounts with end dates built in. Review them monthly, since they are the most commonly forgotten.
Audit the process
Each quarter, compare the active user list with the current staff roster. Investigate any difference. Keep the completed checklists, since they serve as evidence of access control.
Common gaps
- Personal cloud storage accounts holding firm files.
- Mobile email still syncing on a former employee's phone.
- Vendor portals using shared logins.
- Forgotten e-filing and bar association credentials.
Support
Counsel Cyber builds role-based templates and automates much of onboarding and offboarding for law firms. If you would like to compare your current process with these lists, we can review it with you.