When an employee leaves your organization, their access to security systems should be reviewed and removed promptly.
This may include access cards, key fobs, mobile credentials, alarm codes, camera access, remote login permissions, and shared administrator accounts. Delaying these updates can leave former employees with continued access to your building or security system.
Use this checklist as part of your employee offboarding process.
1. Disable Physical Access Credentials
Remove or deactivate any credential assigned to the departing employee, including:
- Access cards
- Key fobs
- Mobile access credentials
- PIN codes
- Biometric access
- Temporary badges
- Parking or gate credentials
Do not simply collect the physical card or fob and assume access has been removed. The credential should also be disabled in the access control system.
If the credential will be reassigned, deactivate it first and update the user information before giving it to someone else.
2. Remove Access Control Permissions
Review the employee’s access permissions and remove them from:
- Exterior doors
- Interior secure areas
- Server or IT rooms
- Inventory areas
- Executive offices
- After-hours access groups
- Restricted floors or departments
- Gates, garages, or loading areas
Check whether the employee had special schedules, extended hours, or access that differed from their department’s standard permissions.
3. Remove Alarm System Access
If the employee had an alarm code, mobile app access, or authority to arm and disarm the system, remove that access.
Also review whether the employee was included on:
- Alarm call lists
- Emergency contact lists
- After-hours notification lists
- Verification contact lists
- Open and close reports
- Escalation procedures
If the employee knew a shared alarm code, consider changing the code rather than only removing the user.
4. Remove Camera System Access
Disable access to video surveillance systems, including:
- Live camera views
- Recorded video
- Video exports
- Shared footage links
- Mobile camera apps
- Web portals
- Video management software
- Cloud camera platforms
Review whether the employee had permission to download, export, or share footage. Those permissions should be removed as part of offboarding.
5. Remove Mobile App and Remote Access
Many modern security systems allow users to control doors, view cameras, receive alerts, or manage alarms from a mobile app.
Remove the departing employee from any connected applications or remote portals. This may include access through platforms used for:
- Access control
- Video surveillance
- Intrusion alarms
- Visitor management
- Intercom systems
- Remote door release
- Security notifications
Removing the app from the employee’s phone is not enough. Their account or credential must be disabled in the security platform.
6. Review Administrator Permissions
Determine whether the employee had administrative access to any security system.
Administrator permissions may allow someone to:
- Add or remove users
- Change door schedules
- Create access groups
- View all cameras
- Export video
- Change alarm settings
- Manage emergency contacts
- Reset passwords
- Create new administrators
Remove the employee’s administrator access immediately. If a shared administrator account was used, change the password and review who still needs access.
7. Change Shared Passwords or Codes
If the departing employee knew any shared login, PIN, alarm code, gate code, or administrator password, update it.
Common shared credentials include:
- Alarm codes
- Gate codes
- Door PINs
- Camera system logins
- Shared mobile app accounts
- Administrator passwords
- Visitor entry codes
- After-hours access codes
Shared credentials are convenient until someone leaves.
8. Update Security Contacts
Review whether the former employee was listed as a security contact.
Remove or replace them from:
- Monitoring company call lists
- Emergency response contacts
- Alarm verification contacts
- Building access contacts
- Service contacts
- Security system administrators
- After-hours contacts
- Incident response teams
Make sure replacement contacts have current phone numbers and email addresses.
9. Collect Physical Security Items
Collect any physical items issued to the employee, such as:
- Access cards
- Key fobs
- Physical keys
- Parking passes
- Garage remotes
- Security tokens
- Visitor badges
- Company mobile devices
- Panic buttons or portable devices
If a physical key cannot be recovered, determine whether the lock should be rekeyed.
10. Review Recent Activity When Appropriate
For sensitive departures, review recent security activity as permitted by your organization’s policies.
This may include:
- Door access history
- After-hours entry
- Camera system login history
- Video exports
- Alarm activity
- Administrator changes
- New users or credentials created
- Unusual access attempts
If you notice suspicious activity, preserve the relevant records and follow your organization’s incident response procedures.
11. Confirm That Access Has Been Removed
After making the changes, verify that:
- The card or fob no longer opens doors
- Mobile credentials are disabled
- Alarm codes no longer work
- Camera access is removed
- Remote logins are disabled
- Administrator permissions are revoked
- Shared credentials have been updated
- Contact lists are current
Document the date the access was removed and who completed the update.
When Should Access Be Removed?
Whenever possible, security access should be disabled at the employee’s effective departure time.
For planned departures, prepare the changes in advance so they can be completed immediately.
For involuntary or high-risk departures, coordinate with HR, management, IT, and security before the employee is notified.
When to Contact MCC
Contact MCC if you need help:
- Removing an access control user
- Deactivating a card or key fob
- Updating alarm codes
- Changing emergency contacts
- Removing camera system access
- Resetting administrator credentials
- Reviewing security system permissions
- Reassigning credentials
- Confirming whether access was removed correctly
When contacting MCC, include:
- Business name
- Employee’s name
- Employee’s location or department
- Systems they had access to
- Effective date and time of removal
- Credentials that need to be disabled
- Replacement contact information, if applicable
- Whether the request is urgent
For immediate or sensitive terminations, call MCC rather than relying only on email.