Offboarding

Offboarding is a list, and the list has to exist before it is needed. Corporate mail and identity provider first, because most other access is recovered through them. Then the accounts that hold money or reach: banking and payment processors, the advertising accounts, the domain registrar, the DNS, the hosting and the code repositories. Then the operational tier: CRM, analytics, project tooling, design files. Last the shared credentials the person knew, every one of which has to be rotated rather than merely removed, because knowledge of a password does not disappear when a seat does.

Two categories are missed almost universally. Personal devices holding company mail, which need a remote wipe of the managed profile rather than a request to delete it. And anything registered in the individual's own name rather than the company's — a domain, an app-store account, a payment gateway, a social profile, an API key issued to their personal address. These are not access problems; they are ownership problems that only become visible at the moment of departure.

In the GCC the sequence has a timing constraint the rest of the world does not. Employment, residence visa and often the phone number and bank account are linked, and the administrative side of a departure runs on its own schedule — notice period, visa cancellation, final settlement. Technical revocation should not wait for any of it. Revoke on the last working day, keep the mailbox alive but forwarded and inaccessible to the leaver for a defined period, and treat the paperwork as a separate track that does not gate the security one.

The company also has to be able to keep operating. Before anything is switched off, transfer ownership of what the person owns — files, calendars, repositories, admin roles on the advertising and business accounts — because a sole administrator removed from a business account can leave that account with no administrator at all, and recovering it is a support case measured in weeks.

Removing the person before transferring what they own

The single most expensive offboarding error, and it is silent: the account is deleted, and with it the sole admin role on the ad account, the ownership of the domain, or the only key to the repository. Run the ownership transfer first, verify a second administrator exists on every critical account, and only then revoke. If the person is leaving on bad terms, do both in the same hour with a second person present.

Least privilege

Giving each person the narrowest access that lets them do their job, so that a compromised or departing account costs the least it can.

---

Named accounts and shared credentials

Access issued to a person rather than to a login everyone uses — the difference between being able to revoke one person and having to change everything.

---

Digital asset register

A written list of every account, domain and system the business depends on, recording who owns it, who administers it, what it costs and how it is recovered.

---

Key-person risk

The number of people whose sudden absence would stop something important — and in most small companies the answer for the digital estate is one.

---

Account recovery path

The chain of accounts that can reset each other's passwords — and therefore the real security level of every account in it, which is the level of the weakest.

All forty-five termsWhat this is regulated by in the UAE

Is this one right in your own numbers?

The definitions are the easy part. Whether the figure on your dashboard was computed this way is a different question, and usually the more expensive one.