# Onboarding and Offboarding Access

# Onboarding and Offboarding Access

*Adapted from GitLab's CorpSec Onboarding/Offboarding Services.*

## Onboarding checklist (new team member)

- [ ] NFE account created in LDAP/Nextcloud, with only the groups the role needs (**not** `admins` by default).
- [ ] The new member sets their own password (generated, unique) and turns on **Nextcloud 2FA** in week one.
- [ ] Password manager set up; see [Password Guidelines](https://bookstack.nearlyfreeenergy.com/books/security/page/password-guidelines).
- [ ] App passwords created per device, not the main password.
- [ ] Reads this Security book, especially *Reporting a Security Incident* and *Email Security and Phishing*.
- [ ] Access to other systems (ERPNext, Plane, BookStack, field devices) requested and recorded by the onboarding buddy.

## Offboarding checklist (leaving or role change), same day

- [ ] Disable the LDAP account (this blocks Nextcloud, mail and Roundcube).
- [ ] Revoke all Nextcloud sessions and app passwords.
- [ ] Remove the person from `admins` and other privileged groups.
- [ ] Remove their SSH keys from servers and field devices. Rotate any shared device or service credentials they knew.
- [ ] Transfer ownership of files, Deck boards, calendars and Library pages they own.
- [ ] Decide on mail: forward to a teammate for a set period or set an auto-reply. Don't leave an active, unwatched mailbox.
- [ ] Recover NFE equipment and wipe it.

For role changes, remove access that the new role doesn't need. **Access is reviewed every quarter**; see [Access Management Policy](https://bookstack.nearlyfreeenergy.com/books/security/page/access-management-policy).