Offboarding a contractor
This checklist is for the site administrator and contract manager of a public body when a contractor, agency or individual consultant finishes work on the site. Do it on the last day, not weeks later.
Contents
Before the last day
- To do: List every access the contractor had: Exponential accounts, server logins, database users, repositories, hosting panel, DNS, monitoring, mail.
- To do: Collect the handover: code in your repository, documentation, open issues, credentials they created (The end of a contract).
- To do: Make sure named staff of your organization have administrator access before the contractor's is removed.
In Exponential
- To do: Deactivate or remove the contractor's accounts; with Deactivate and move enabled, accounts move to a hidden group without roles and can be restored (Check user accounts).
- To do: Content they own can be given to a staff member (Changing the owner of content).
- To do: Remove their role assignments; check roles they may have created (Roles and policies).
- To do: Revoke their personal API keys (Personal API keys) and any OAuth clients (Setup > oAuth admin).
- To do: Sign out their sessions in Setup > Sessions (Sessions).
- To do: Their drafts and pending items reassigned or removed (My drafts and my pending items).
- To do: Workflows where they were the approver updated (Workflows).
- To do: Remove their addresses from maintenance-mode allow lists and debug output lists (Maintenance mode).
Servers and services
- To do: Remove their SSH keys and server accounts (Per-customer users and pools).
- To do: Change passwords they knew: database, hosting panel, shared mailboxes.
- To do: Rotate secrets they had access to, after checking what each one breaks: rotating the e-mail preferences secret invalidates every unsubscribe link already sent (Backups: keys and secrets).
- To do: Remove their access to repositories, monitoring and DNS.
- To do: Remove their e-mail from alert recipients:
./console exp:audit alerts recipients(Security and audit).
Check and record
- To do: Review their last actions in the audit trail (
/audit/console). - To do: Try signing in with their old account from a test browser: it must fail.
- To do: Record what was removed, by whom, when.
- To do: Confirm in writing that the contractor returned or deleted any copies of your data, as the contract requires.
Related pages
- Government checklists
- Quarterly access review
- Customer offboarding (for hosts)
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.