Catch Advisors
IT Strategy

IT Onboarding and Offboarding Guide for Mid-Market CIOs

Most companies feel onboarding and offboarding problems before they measure them.

A new employee starts, but the laptop is not ready. Their email works, but the main business app does not. Their manager opens three tickets. The employee spends the first day waiting instead of working.

Then, on the other side, someone leaves the company. Their account gets disabled in Microsoft 365, but they still have access to a SaaS tool. Their phone number is still active. A shared password was never changed. A vendor portal still lists them as an admin.

These are not small process issues. They are security, productivity, and compliance risks.

For mid-market companies, IT onboarding and offboarding must be more than a checklist buried in HR. They need to be managed business processes with clear ownership, standard steps, and regular audits.

This guide explains how CIOs and IT Directors can build a practical onboarding and offboarding process that supports growth without creating unnecessary risk.

Why Onboarding and Offboarding Matter

Every employee lifecycle event touches IT.

New hires need devices, accounts, permissions, phone access, collaboration tools, security training, and application access. Role changes need updates to groups, licenses, and approvals. Departures need fast access removal, equipment recovery, data preservation, and vendor cleanup.

When this process is weak, the business feels it in several ways.

First, productivity suffers. New employees cannot do their jobs if IT is waiting on unclear requests, missing approvals, or last-minute hardware needs.

Second, support tickets increase. If onboarding is inconsistent, every new hire becomes a custom project.

Third, security risk grows. Over time, users collect access they no longer need. Former employees may keep access to systems that were missed during offboarding.

Fourth, audits become painful. If IT cannot show who approved access, when accounts were disabled, or what systems were reviewed, the company may struggle with insurance, compliance, or customer security reviews.

A strong onboarding and offboarding process reduces these problems. It gives the business a repeatable way to add, change, and remove access.

Start With Ownership

The first question is simple: who owns the process?

HR usually owns the employee record. The hiring manager owns the role and business access needs. IT owns accounts, devices, security controls, and technical execution. Security or compliance may own certain approval rules.

The process breaks when these teams assume someone else is responsible.

Define ownership clearly:

  • HR starts the workflow when a person is hired, changes roles, or leaves
  • The manager confirms role, location, start date, equipment needs, and application access
  • IT provisions or removes devices, accounts, licenses, and permissions
  • Security reviews high-risk access and confirms offboarding controls
  • Finance or procurement manages hardware purchasing, SaaS licenses, and asset records

This does not need to be complex. A simple RACI chart can help. The goal is to make sure every step has one clear owner.

If no one owns the full process, the CIO should assign an operational owner inside IT who can coordinate with HR and department leaders.

Build Standard Role Profiles

Many onboarding delays happen because every request starts from scratch.

The manager says, “Set them up like Sarah.” IT then has to guess what that means. Does Sarah have standard access, admin access, legacy access, or extra licenses from an old project?

That is risky.

Instead, create standard role profiles. A role profile lists the typical equipment, accounts, groups, apps, licenses, and permissions for a job type.

For example:

  • Sales employee
  • Finance manager
  • Contact center agent
  • Operations supervisor
  • Developer
  • Executive assistant
  • Remote employee
  • Contractor
  • IT administrator

Each profile should include:

  • Device type
  • Microsoft 365 or Google Workspace license
  • Phone or UCaaS access
  • Core applications
  • Security groups
  • Shared drives or SharePoint sites
  • MFA requirements
  • VPN or ZTNA access
  • Required training
  • Approval requirements for sensitive systems

Role profiles help IT move faster while keeping access controlled. They also make it easier to review access later.

Create a Clean Intake Process

IT cannot onboard someone well if the request arrives late or incomplete.

Create one standard intake form for new hires and role changes. It should collect the information IT needs before work begins.

At minimum, include:

  • Legal name and preferred name
  • Personal email or contact method before start date
  • Job title and department
  • Manager
  • Start date
  • Work location
  • Remote or office status
  • Employee, contractor, or temporary status
  • Device type needed
  • Phone or contact center needs
  • Required applications
  • Special access requests
  • Cost center or approval details

Set a service level target. For example, HR and managers must submit new hire requests at least five business days before the start date.

The same idea applies to offboarding. IT needs the termination date, time of access removal, manager instructions for email and file handling, equipment recovery details, and any legal hold requirements.

A clean intake process removes guesswork.

Automate What You Can, But Keep Controls

Automation can help a lot, but only if the process is already clear.

Identity platforms, HR systems, IT service management tools, and device management platforms can automate many steps:

  • Create user accounts
  • Assign groups based on role
  • Apply license templates
  • Trigger device provisioning
  • Enforce MFA
  • Send training tasks
  • Disable accounts after termination
  • Remove group memberships
  • Open asset return tasks

But automation should not mean uncontrolled access.

High-risk permissions still need approval. Examples include finance systems, HR systems, admin roles, security tools, customer data platforms, and production systems.

Use automation for standard access. Use approvals for elevated or sensitive access.

For many mid-market companies, the first step is not a major platform purchase. It is building a better workflow in tools they already use.

The key is to connect the employee record to IT action. HR events should trigger IT workflows, not depend on hallway conversations or forwarded emails.

Make Offboarding Fast and Complete

Offboarding is where small gaps create large risk.

A basic offboarding checklist should include:

  • Disable SSO and primary identity accounts
  • Revoke active sessions when possible
  • Remove MFA methods or reset recovery options
  • Disable email or convert mailbox access based on policy
  • Transfer files, shared ownership, and calendars as needed
  • Remove access to SaaS applications
  • Remove VPN, ZTNA, and remote access
  • Remove phone, UCaaS, and contact center access
  • Recover laptop, mobile device, badge, and tokens
  • Remove local admin access
  • Rotate shared passwords if used
  • Remove vendor portal access
  • Update asset records
  • Confirm legal hold or data retention rules

Timing matters. For involuntary departures, access removal may need to happen at a specific time. For normal resignations, IT should still have a planned cutoff.

The biggest mistake is assuming SSO solves everything. Many SaaS tools still have local users, external sharing links, API tokens, service accounts, or admin portals that may not be fully controlled by SSO.

Build an application inventory so offboarding covers every system that matters.

Handle Contractors Separately

Contractors, vendors, and temporary workers need special attention.

They often need fast access, but they may not follow the same HR process as full-time employees. That makes them easy to miss.

Create a separate contractor onboarding process with:

  • Business sponsor
  • End date
  • Required systems
  • Data access limits
  • Device ownership rules
  • MFA requirements
  • Security training
  • Contract or NDA confirmation
  • Review date

Every contractor account should have an expiration date. If access needs to continue, the sponsor should renew it.

This one control can reduce a lot of stale access.

Measure the Process

If onboarding and offboarding are important, measure them.

Useful metrics include:

  • Percent of new hire requests submitted on time
  • Percent of new hires ready on day one
  • Average time to provision accounts
  • Number of onboarding tickets per new hire
  • Number of access exceptions
  • Time from termination notice to account disablement
  • Percent of assets recovered within policy
  • Number of stale accounts found in audits
  • Number of apps included in offboarding review

These metrics help IT show value. They also help the business see where process failures start.

For example, if IT misses day-one readiness because requests arrive one day before start date, that is not only an IT problem. It is a cross-functional process issue.

Review Access After Onboarding

Access should not be “set it and forget it.”

After 30 or 60 days, review whether the employee still needs the access they received. This is especially important for new managers, finance roles, executives, IT admins, and contractors.

Managers should confirm that access matches the job. IT should remove anything that was temporary or no longer needed.

This keeps onboarding from becoming the start of long-term access sprawl.

Common Mistakes to Avoid

Mid-market IT teams should watch for these common issues:

  • Relying on manual emails instead of a formal workflow
  • Letting managers request access by copying another employee
  • Missing SaaS apps that are not tied to SSO
  • Giving too much access on day one
  • Forgetting contractors and vendors
  • Not tracking device return
  • Not rotating shared credentials
  • Not documenting approvals
  • Treating offboarding as complete after email is disabled
  • Never auditing stale accounts

None of these require a huge team to fix. They require clear ownership, better intake, standard profiles, and regular review.

A Practical 30-Day Improvement Plan

If your process is messy today, start small.

Week one: map the current onboarding and offboarding steps. Identify every handoff between HR, managers, IT, security, and finance.

Week two: create a standard intake form and define required lead times. Pick the top five roles and build role profiles.

Week three: build or improve the workflow in your ticketing, HR, identity, or collaboration tool. Add approvals for sensitive access.

Week four: test the process with one new hire and one offboarding event. Measure what worked and what broke.

The goal is not perfection. The goal is a process that is predictable, secure, and easy enough for the business to follow.

Final Thought

Onboarding and offboarding are not just IT chores. They are core operating controls.

Good onboarding helps employees become productive faster. Good offboarding protects the company when people leave. Together, they reduce support burden, security gaps, audit pain, and unnecessary software spend.

For CIOs and IT Directors, this is one of the highest-leverage places to improve IT operations.

If you want an outside view of your IT processes, vendor stack, identity controls, or security gaps, Catch Advisors can help. Visit catchadvisors.com to start the conversation.