Construction and energy services companies hire quickly. Crews ramp up for a project, seasonal workers arrive, and some leave as fast as they came. Every hire and departure has an IT side: accounts, devices, apps, and access to project data. When this process is informal, two things go wrong. New people wait days for what they need, and former employees keep access for months.
A simple, written checklist fixes both. This one is designed so that a project manager or HR coordinator can start it, and IT can complete it.
Why this matters more than it seems
An active account belonging to a former employee is a risk you cannot see. If their password was reused or stolen, the attacker walks in with legitimate credentials. Departing employees may also take project files or contacts with them. And in regulated work, you may be asked to show who had access to what and when.
On the other side, a new hire sitting idle for three days because nobody ordered a laptop is simply expensive.
Onboarding checklist
Before the first day
- Request submitted. HR or the supervisor completes a short form: name, start date, job title, location, supervisor, and what systems the role needs.
- Role-based access chosen. Use standard bundles for roles such as superintendent, project manager, estimator, accountant, and laborer. Avoid copying another person's access, which tends to carry over unneeded rights.
- Accounts created. Email, identity account, and application access such as Procore, accounting, and timekeeping, according to the role.
- Device prepared. Laptop, tablet, or phone is configured, encrypted, enrolled in management, and shipped to the jobsite if needed.
- Multi-factor authentication ready. The new hire's authenticator is set up on the first day, with help if necessary.
First day
- Hand over devices with a short orientation: how to get help, how to report a suspicious email, and what not to do, such as using personal email for company files.
- Have the employee sign the acceptable use policy.
- Confirm they can log in to each system they need.
- Give them a phone number and an email address for support, in writing.
First weeks
- Complete security awareness training within the first thirty days.
- Review access with the supervisor after a short period and trim anything unneeded.
Seasonal and temporary workers
For short-term crews, consider limited accounts, shared kiosk-style devices with individual sign-ins, or restricted apps instead of full accounts. Set an expiration date on each account when it is created, so access ends automatically if nobody remembers to remove it.
Role changes
Promotions and transfers deserve their own step. When someone moves from one project or department to another, remove access they no longer need. This is where old permissions pile up.
Offboarding checklist
Planned departures
- Notice received. HR notifies IT as soon as a departure date is known.
- Access end scheduled. Set the exact date and time accounts will be disabled.
- Knowledge transfer. The employee shares important files, contacts, and active tasks with their supervisor.
On the last day, or immediately for involuntary exits
- Disable the identity account, which blocks email and connected apps.
- Sign out active sessions and reset the password.
- Remove access to project platforms, accounting, remote access, and shared mailboxes.
- Remove the person from MFA registration and revoke devices.
- Recover laptops, phones, tablets, keys, badges, and fuel or credit cards.
- Remotely lock or wipe lost or unreturned company devices.
- Forward email and transfer files according to policy, rather than leaving the account open.
Afterward
- Convert the mailbox to a shared mailbox or archive it, based on retention needs.
- Reassign licenses so you stop paying for them.
- Record completion with date and the person who did it.
Measure and audit
Once a quarter, compare the active user list with the payroll roster. Anyone who appears in one and not the other deserves an explanation. Track how long onboarding and offboarding take, and fix the delays.
Getting it running
Ironfield Cyber manages onboarding and offboarding for contractors and energy companies as part of our managed IT service. If you would like a checklist tailored to your roles and systems, we can build one with you.