When an employee leaves a business — whether on good terms or not — the security risk isn't the departure itself. It's the gap between their last day and the moment every system they had access to is actually locked down. That gap is often measured in days or weeks, and it's one of the most preventable risks in SMB security.

Why this happens. Offboarding usually involves multiple disconnected systems — email, file storage, VPN, shared logins, physical badges, third-party SaaS tools an employee signed up for independently — and no single person is always responsible for closing all of them at once. HR may handle the formal exit; IT may not be notified the same day, especially with short notice or unexpected departures.

What's actually at risk during that gap: A former employee (or someone who gained access to their still-active credentials) can retain access to client data, financial systems, or shared drives well after they've left the organization — and for regulated businesses, that gap itself can be a compliance finding, independent of whether anything was actually misused.

Why this specifically matters for HIPAA and GLBA-covered businesses. Both frameworks require access to be revoked promptly when it's no longer needed — "promptly" being interpreted by examiners as same-day or next-day, not "whenever IT gets to it."

Recommended actions:

• Maintain a complete, current inventory of every system each employee has access to — you can't revoke access you don't know exists
• Establish a same-day offboarding checklist that includes email, file access, VPN, shared/admin accounts, and any SaaS tools staff use independently
• Require HR and IT to communicate departures immediately, including unplanned ones, not just scheduled resignations
• Review access lists periodically, not just at offboarding — dormant accounts for people who left months ago are a common and avoidable finding