First and foremost, this means that the IT department needs to be notified when an employee is terminated. The situation will dictate when this notification is appropriate; sometimes it may be better to have the IT department on standby for further instructions while other times notification won’t be needed until after the employee is notified. Either way, the IT department MUST be a part of the process to help preserve and protect company property and infrastructure. When your IT department isn’t included you can end up with security holes in your infrastructure that could be accessed by a disgruntled employee, or you could lose valuable information if an employee deletes data from a computer or data store.So, what does your IT department really need to be doing about an employee termination? First, all access an employee had to company resources should be locked down. This can be done by changing passwords or disabling user accounts, whichever is appropriate for the situation. Second, preserving information should be paramount. Computers may need to be imaged with a forensic tool such as FTK Imager (a free tool from AccessData), email accounts need to be backed up or archived in Exchange, and any cloud storage accounts need to be reviewed. That last point may require gaining access to the account(s), which can be easy or difficult depending on how the employee set things up. And, backing up computers may mean getting them back from the employee, which isn’t always easy if the situation is tense. Third, email accounts need to be given to someone else in the company that can take over where the former employee left off. This can be done by simply giving the current employee a way to access the email or an automated response can be set directing everyone to the new person. In some cases, it may be best to delete the email account and create an alias under the new person, but only after backing up the old account first. And last, the company needs to take steps to delegate responsibilities properly. If this isn’t done sales could be lost or meetings could be missed, which leaves the company looking bad or worse. This may not require the IT department to facilitate, but sometimes technical help is needed to get those in the company that pick up the responsibilities access to what they need out of the old employee’s files or accounts.
This is starting to sound like an awful lot of effort, but some steps may not be necessary every time. For instance, forensic images take a long time to make. It’s not something that requires a person’s full attention the entire time, but if there is any question about illegal activity or a future lawsuit over proper compensation and wages then preserving evidence will go a long way to helping the company through the ordeal. However, this cannot be done after-the-fact, it can only be done at the time the employee first leaves. Once someone else is using that computer the evidence is tainted and won’t carry as much weight, if any, during litigation. But, if there isn’t any concern about future litigation or previous illegal activity then a forensic image may not be necessary. And, most companies these days do a decent job of limiting their employees’ use of unapproved products and services, so things like random cloud accounts aren’t usually a big issue.
Ultimately it’s up to the person or people in charge to decide how to handle a given situation, but every company should have a standard set for how to deal with employee terminations, and in the world we live in this must include the IT department in the process. Whatever procedures are decided upon should be well documented, and every manager or person with authority should know them and be able to reference a single standard template. Without good policies and procedures in place that include the IT department a company could end up losing face in the eyes of their customers and partners or leaving itself open to an extensive amount of damage.
