Onboarding and Offboarding Access

Onboarding and Offboarding Access 
 Adapted from GitLab's CorpSec Onboarding/Offboarding Services. 
 Onboarding checklist (new team member) 
 
 NFE account created in LDAP/Nextcloud, with only the groups the role needs ( not admins by default). 
 The new member sets their own password (generated, unique) and turns on Nextcloud 2FA in week one. 
 Password manager set up; see Password Guidelines . 
 App passwords created per device, not the main password. 
 Reads this Security book, especially Reporting a Security Incident and Email Security and Phishing . 
 Access to other systems (ERPNext, Plane, BookStack, field devices) requested and recorded by the onboarding buddy. 
 
 Offboarding checklist (leaving or role change), same day 
 
 Disable the LDAP account (this blocks Nextcloud, mail and Roundcube). 
 Revoke all Nextcloud sessions and app passwords. 
 Remove the person from admins and other privileged groups. 
 Remove their SSH keys from servers and field devices. Rotate any shared device or service credentials they knew. 
 Transfer ownership of files, Deck boards, calendars and Library pages they own. 
 Decide on mail: forward to a teammate for a set period or set an auto-reply. Don't leave an active, unwatched mailbox. 
 Recover NFE equipment and wipe it. 
 
 For role changes, remove access that the new role doesn't need. Access is reviewed every quarter ; see Access Management Policy .