Construction and energy companies hire and release people constantly. Crews ramp up for a project, seasonal workers come and go, and subcontractors rotate through. Every one of those transitions creates IT risk: accounts that stay active after someone leaves, laptops that never come back, and new hires who wait days for access they need to work.
A consistent checklist solves both problems. It gets new people productive quickly and closes the doors behind departing ones. Here is a practical version you can adapt.
Why this matters more than it seems
An active account belonging to a former employee is an unmonitored way into your systems. Nobody is watching it, nobody notices unusual sign-ins, and the former employee's password may have been reused elsewhere and exposed. It also leaves company data on personal phones and in personal cloud accounts long after the relationship has ended.
On the other side, slow onboarding costs real money. A foreman who cannot sign in to the project platform on day one is a paid person waiting.
The onboarding checklist
Before the first day
- Request submitted by the hiring manager. Include name, role, start date, location, and which projects they will join.
- Role-based access defined. Use a template per role, such as estimator, superintendent, or accountant, rather than copying another person's access.
- Accounts created. Email, project platform, accounting access if needed, and any field apps.
- Device prepared. Laptop, phone, or tablet enrolled in management, encrypted, patched, and configured with the required software.
- MFA enrolled. Set up on the device before it ships or is handed over.
On the first day
- The employee signs an acceptable use policy that covers company and personal devices.
- They receive a brief orientation on recognizing phishing and payment fraud, and how to report suspicious messages.
- A password manager is set up and explained.
- Emergency contacts are shared: who to call for help, and how to report a lost device.
In the first month
Follow up to confirm they have what they need, remove any temporary extra access, and make sure they have completed training.
The offboarding checklist
Offboarding should be triggered by HR or the manager as soon as a departure is known, not after the last day.
- Set the access end time. For routine departures, schedule account disablement for the end of the last working day. For involuntary or sensitive departures, disable access before or during the conversation.
- Disable accounts. Email, project tools, accounting, remote access, VPN, and any shared services. Prefer central identity management so disabling one account cuts access broadly.
- Reset shared credentials. If the person knew shared passwords, such as for a jobsite router or a vendor portal, change them.
- Recover devices. Collect laptops, phones, tablets, badges, keys, and any hotspots. Record what was returned.
- Preserve data. Transfer ownership of files and mailboxes to a manager before deleting anything. Retain data as required by your policies and legal obligations.
- Remove from groups and distribution lists. Include project channels and external collaboration sites.
- Wipe or reassign. Securely erase returned devices before reuse.
- Remote wipe where needed. If a device is not returned, use device management to wipe company data.
- Document it. Keep a record of what was done and when.
Special cases
Seasonal and temporary workers
Set an end date on the account when it is created so it expires automatically unless renewed.
Subcontractors and vendors
Give outside parties accounts that are separate from employee accounts, limit them to specific projects, and review them on a schedule. Do not hand out a shared company login.
Personal devices
If staff use personal phones for email, require a basic management policy that can remove company data without wiping personal content, and make sure employees understand this in advance.
Measure it
Track how long onboarding takes and whether any accounts remain active for departed staff. A quarterly review comparing the HR roster against active accounts will catch stragglers.
Support from Ironfield Cyber
Ironfield Cyber can build role-based templates, automate account setup and removal where your systems allow it, and run the quarterly access review for you. If your current process depends on someone remembering to send an email, we can help make it more reliable.