Employee Onboarding and Offboarding Policy (example)

1. Before the first day. HR registers the new employee with start date, manager, team and role. The manager requests the access the role needs; IT grants access only after the manager's approval. Access to systems with personal data also requires the data owner's approval.
2. Agreements. The employment contract and a confidentiality agreement are signed before the first day.
3. First week. The employee reads and confirms the information security policy, the code of conduct and the privacy policy, and passes the security awareness test (pass mark 80%).
4. Equipment. IT hands out a laptop and phone and records serial numbers against the employee.
5. Probation review. The manager holds a review before the end of the six-month probation period.
6. Offboarding. When employment ends, the manager starts offboarding at least five working days before the last day. IT removes all access on the last day, the employee returns all equipment, and HR confirms that the confidentiality obligations continue.
7. Yearly access review. Each manager reviews the access of their team every year.
8. Records. Onboarding and offboarding records are kept for the length of employment plus two years.