When the person who knows your IT leaves

Before they go

• Collect every admin login: Microsoft 365, the firewall, Wi-Fi, servers, backup systems, the domain registrar, website hosting and business software. Store them in a company password manager.
• Change ownership of any account registered to their personal email or phone number.
• Ask for documentation: what equipment there is, how it is set up, where backups go and anything unusual.
• List the vendors and contracts they dealt with, and who to call.
• Ask what is in progress or overdue: renewals, warranties, updates, known problems.
• Arrange a handover with whoever takes over, in person if possible.

After they leave

• Change every admin password they knew, including shared ones.
• Remove their accounts or convert them, and check for remote access tools they used.
• Check multi-factor authentication on admin accounts is tied to the business instead of their personal phone.
• Confirm backups are still running and someone is checking them.

Prevent it next time

The risk is relying on one person’s memory. Documentation, a company password manager, admin accounts owned by the business and more than one person who knows how to reach help reduce that risk, whoever looks after your IT.