Onboarding and Offboarding Access

Onboarding and Offboarding Access

Adapted from GitLab's CorpSec Onboarding/Offboarding Services.

Onboarding checklist (new team member)

• NFE account created in LDAP/Nextcloud, with only the groups the role needs (not admins by default).
• The new member sets their own password (generated, unique) and turns on Nextcloud 2FA in week one.
• Password manager set up; see Password Guidelines.
• App passwords created per device, not the main password.
• Reads this Security book, especially Reporting a Security Incident and Email Security and Phishing.
• Access to other systems (ERPNext, Plane, BookStack, field devices) requested and recorded by the onboarding buddy.

Offboarding checklist (leaving or role change), same day

• Disable the LDAP account (this blocks Nextcloud, mail and Roundcube).
• Revoke all Nextcloud sessions and app passwords.
• Remove the person from admins and other privileged groups.
• Remove their SSH keys from servers and field devices. Rotate any shared device or service credentials they knew.
• Transfer ownership of files, Deck boards, calendars and Library pages they own.
• Decide on mail: forward to a teammate for a set period or set an auto-reply. Don't leave an active, unwatched mailbox.
• Recover NFE equipment and wipe it.

For role changes, remove access that the new role doesn't need. Access is reviewed every quarter; see Access Management Policy.